Windows Event Log Cleared (Microsoft-Windows-Eventlog EventID 104)

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies when a Windows Event Log is cleared by matching Microsoft-Windows-Eventlog events with EventID 104. Clearing event logs can help attackers reduce forensic visibility and hinder incident investigation. It relies on Windows System telemetry for the EventID and Provider_Name fields and excludes specific channels already covered elsewhere, focusing on remaining event log channels.

Reporting behind it

Related detections9 linkedT1685.005 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Suspicious Event Log Clearing via Wevtutil (via process_creation)

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

Malicious Event Log Clear Attempt - Wmi (via process_creation)

Malicious Event Log Clear Attempt - Command (via process_creation)

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

Malicious Clearing of Windows Event Logs (via process_creation)

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

Windows Event Log Cleared (Microsoft-Windows-Eventlog EventID 104)

Pivot detection · T1685.005 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-event-log-cleared-microsoft-windows-eventlog-event-id-104-a62b37e0

title: Windows Event Log Cleared (Microsoft-Windows-Eventlog EventID 104)
id: f66ee38a-59a7-4308-a7df-7d1c21a59cb6
related:
  - id: f2f01843-e7b8-4f95-a35a-d23584476423
    type: obsolete
  - id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982
    type: derived
  - id: 100ef69e-3327-481c-8e5c-6d80d9507556
    type: derived
  - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b
    type: derived
status: test
description: This rule identifies when a Windows Event Log is cleared by matching Microsoft-Windows-Eventlog events with EventID 104. Clearing event logs can help attackers reduce forensic visibility and hinder incident investigation. It relies on Windows System telemetry for the EventID and Provider_Name fields and excludes specific channels already covered elsewhere, focusing on remaining event log channels.
references:
  - https://twitter.com/deviouspolack/status/832535435960209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-01-10
modified: 2023-11-15
tags:
  - attack.defense-impairment
  - attack.t1685.005
  - car.2016-04-002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 104
    Provider_Name: Microsoft-Windows-Eventlog
  filter_main_covered:
    Channel:
      - Microsoft-Windows-PowerShell/Operational
      - Microsoft-Windows-Sysmon/Operational
      - PowerShellCore/Operational
      - Security
      - System
      - Windows PowerShell
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  - System provisioning (system reset before the golden image creation)
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL