Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies when a Windows Core Event Log is cleared by matching EventID 104 from the Microsoft-Windows-Eventlog provider. Clearing event logs can help an attacker reduce visibility by removing forensic evidence and weakening detection opportunities. It relies on System logs capturing EventID 104, including the affected Channel information (e.g., Security, System, PowerShell operational logs).

Reporting behind it

Related detections9 linkedT1685.005 — drag to rearrange

Malicious Security Event Log Disabled via wevtutil

Suspicious Event Log Clearing via Wevtutil (via process_creation)

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

Malicious Event Log Clear Attempt - Wmi (via process_creation)

Malicious Event Log Clear Attempt - Command (via process_creation)

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

Malicious Clearing of Windows Event Logs (via process_creation)

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)

Pivot detection · T1685.005 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-system-eventlog-cleared-event-id-104-100ef69e

title: Windows Event Log Cleared (EventID 104, Microsoft-Windows-Eventlog)
id: 78feca32-739a-4e32-884f-1c1a391f831f
related:
  - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b
    type: derived
  - id: 100ef69e-3327-481c-8e5c-6d80d9507556
    type: derived
status: test
description: This rule identifies when a Windows Core Event Log is cleared by matching EventID 104 from the Microsoft-Windows-Eventlog provider. Clearing event logs can help an attacker reduce visibility by removing forensic evidence and weakening detection opportunities. It relies on System logs capturing EventID 104, including the affected Channel information (e.g., Security, System, PowerShell operational logs).
references:
  - https://twitter.com/deviouspolack/status/832535435960209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-17
modified: 2023-11-15
tags:
  - attack.defense-impairment
  - attack.t1685.005
  - car.2016-04-002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 104
    Provider_Name: Microsoft-Windows-Eventlog
    Channel:
      - Microsoft-Windows-PowerShell/Operational
      - Microsoft-Windows-Sysmon/Operational
      - PowerShellCore/Operational
      - Security
      - System
      - Windows PowerShell
  condition: selection
falsepositives:
  - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
  - System provisioning (system reset before the golden image creation)
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL