Windows Security and Eventlog Clear Activity (Event IDs 517, 1102)

Flags Windows event log clearing using Security Event ID 517 and Microsoft-Windows-Eventlog Event ID 1102.

FreeUnreviewedSigmahighv1

windows-security-and-eventlog-clear-activity-event-ids-517-1102-d99b79d2

title: Windows Security and Eventlog Clear Activity (Event IDs 517, 1102)
id: 3f4db2d8-df65-4046-8e7e-f4587d2c51c8
related:
  - id: f2f01843-e7b8-4f95-a35a-d23584476423
    type: obsolete
  - id: a122ac13-daf8-4175-83a2-72c387be339d
    type: obsolete
  - id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982
    type: derived
status: test
description: This rule identifies when Windows event logs are cleared by matching Security log Event ID 517 and Microsoft-Windows-Eventlog Event ID 1102 with the expected provider names. Clearing logs can hinder investigations and is often used to impair defensive monitoring after an attacker gains access. Detection relies on Windows Security service telemetry containing these event records.
references:
  - https://twitter.com/deviouspolack/status/832535435960209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_audit_log_cleared.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-01-10
modified: 2022-02-24
tags:
  - attack.defense-impairment
  - attack.t1685.005
  - car.2016-04-002
logsource:
  product: windows
  service: security
detection:
  selection_517:
    EventID: 517
    Provider_Name: Security
  selection_1102:
    EventID: 1102
    Provider_Name: Microsoft-Windows-Eventlog
  condition: 1 of selection_*
falsepositives:
  - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  - System provisioning (system reset before the golden image creation)
level: high
license: DRL-1.1

What it detects

This rule identifies when Windows event logs are cleared by matching Security log Event ID 517 and Microsoft-Windows-Eventlog Event ID 1102 with the expected provider names. Clearing logs can hinder investigations and is often used to impair defensive monitoring after an attacker gains access. Detection relies on Windows Security service telemetry containing these event records.

Known false positives

Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
System provisioning (system reset before the golden image creation)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.