Security log cleared
A security / audit log was cleared, in ANY log format.
What it detects
A security / audit log was cleared, in ANY log format. Clearing logs is a deliberate anti-forensics move to destroy evidence of an intrusion — it is almost never a routine action. This provider-agnostic rule keys on the canonical action the generic enrichment assigns to "log cleared" / "wevtutil cl" / "audit log was cleared" phrases, so it fires even on a format we have no dedicated parser for.
MITRE ATT&CK mapping
- T1070.001Indicator Removal: Clear Windows Event Logs· Defense Evasion
False positives and triage
Scheduled log rotation and legitimate maintenance can clear logs. The signal is a clear that is unscheduled, performed by an unexpected account, or correlated with other suspicious activity on the same host. Confirm who cleared it and when.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/multi/security_log_cleared.yaml, licensed under the Apache License 2.0.
id: multi.defense_evasion.security_log_cleared
version: 1.1.0
status: stable
severity: high
confidence: 0.75
platforms: [windows, linux, macos, network, application]
mitre_techniques: [T1070.001]
description: |
A security / audit log was cleared, in ANY log format. Clearing logs is a
deliberate anti-forensics move to destroy evidence of an intrusion — it is
almost never a routine action. This provider-agnostic rule keys on the canonical
action the generic enrichment assigns to "log cleared" / "wevtutil cl" /
"audit log was cleared" phrases, so it fires even on a format we have no
dedicated parser for.
match:
# Keys within `match:` are ANDed. Pairing the canonical action with a
# raw_message phrase therefore made this rule unfireable: a parsed Windows
# clear sets the action but carries no such phrase, and an unparsed format
# carries the phrase only because the generic enrichment ALREADY turned it
# into this action. `security_control` is the category that enrichment
# assigns, which is exactly the "no dedicated parser" case this rule is for —
# platform rules own the parsed ones (`audit`), so the two do not overlap.
event_category: security_control
event_action_any:
- log_cleared
correlation_keys: [hostname]
false_positive_guidance: |
Scheduled log rotation and legitimate maintenance can clear logs. The signal is
a clear that is unscheduled, performed by an unexpected account, or correlated
with other suspicious activity on the same host. Confirm who cleared it and when.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.