federal-homelab

Clear Windows Event Logs

Field	Value
ATT&CK technique	T1070.001 — Indicator Removal: Clear Windows Event Logs
Tactic	Defense Evasion
Log source	Windows Security and System event logs (WS01)
Index	lab_win
Severity	Critical
Status	Not validated — no atomic test available (see below)
Author	Samuel Emerson
Created	2026-09-24
Validated	—

Hypothesis

Clearing the event log is a late-stage action taken to destroy evidence. Windows records it even as it happens: clearing the Security log writes event 1102, and clearing any other log writes System event 104. Because these events are generated by the act of clearing itself, they are reliable — though only if the logs are being forwarded off the host first, which is exactly what this pipeline does. Events already sent to Splunk survive a local clear.

Detection logic

index=lab_win
    ((source="XmlWinEventLog:Security" EventCode=1102) OR (source="XmlWinEventLog:System" EventCode=104))
| table _time host source EventCode SubjectUserName Channel

Field reference

Field	Source	Meaning
EventCode=1102	Security log	The Security audit log was cleared
EventCode=104	System log	An event log was cleared (Channel names which)
SubjectUserName	1102	The account that cleared the log
Channel	104	The log that was cleared

Validation

Not performed. The Atomic Red Team release cloned on 2026-09-24 contains no T1070.001 test folder — only the parent T1070 and other sub-techniques (.003–.008). The detection is written and scheduled in Splunk, but it has not been fired against real telemetry, so it does not meet this repository’s bar for a validated detection.

The logic rests on documented, deterministic behavior: Windows writes 1102 and 104 whenever a log is cleared, regardless of how the clear is performed (wevtutil cl, Clear-EventLog, the Event Viewer UI, or API). The risk in leaving it unvalidated is a field-name or source mismatch, not whether the events exist.

Closure: validate with any log-clear action once a suitable test is available, or by clearing a disposable log on WS01 and confirming 1102/104 reach Splunk and the alert fires.

Response guidance

1. A 1102 or 104 from an interactive user is high priority; treat it as evidence destruction until shown otherwise.
2. The cleared events are gone locally but the forwarded copies remain in Splunk — reconstruct the host’s recent activity from index=lab_win and index=lab_sysmon around the clear time.
3. Identify the clearing account and correlate with the session that preceded it.

Gaps

• Not yet validated (above).
• An adversary who stops the Event Log service instead of clearing it, or who tampers with forwarding, would not produce 1102/104. The forward-first design mitigates the first case, because events already sent are retained.

NIST 800-53 mapping

Control	Relevance
AU-9	Protection of audit information — detecting attempts to destroy it
AU-6	Audit review and analysis
SI-4	System monitoring for anti-forensic activity