name: Windows Event Log Cleared
id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
version: 4
date: '2020-07-06'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: This search looks for Windows events that indicate one of the Windows
  event logs has been purged.
search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system`
  EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
  dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_event_log_cleared_filter`
how_to_implement: To successfully implement this search, you need to be ingesting
  Windows event logs from your hosts.
known_false_positives: It is possible that these logs may be legitimately cleared
  by Administrators.
references: []
tags:
  analytic_story:
  - Windows Log Manipulation
  - Ransomware
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 5
  - CIS 6
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1070.001
  nist:
  - DE.DP
  - PR.IP
  - PR.AC
  - PR.AT
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - dest
  security_domain: endpoint
