SOC Event Lookup
Event ID 1102AuditLogP1

Windows Event ID 1102: The audit log was cleared

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 1102 records clearing of the Windows Security audit log and is a high-confidence defense-evasion signal.

Technical Metadata

Technical metadata for Event ID 1102
Event ID1102
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1070.001 Indicator Removal: Clear Windows Event Logs
Key fields to watchSubject, Logon ID, Computer

Trigger Scenarios

The event is generated when a user or process clears the Security log. It can be logged immediately before older records are removed.

Key Fields

Subject

The identity associated with the log clear. A local SYSTEM context still requires correlation to the initiating process or administrator.

Logon ID

The session identifier used to join the event to 4624 and 4688 activity.

Computer

The host whose Security log was cleared. Domain controllers and critical servers have heightened impact.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 1102
SecurityEvent
| where EventID == 1102
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 1102
index=wineventlog source="WinEventLog:Security" EventCode=1102
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 1102
dataset = microsoft_windows_raw
| filter edr_event_id = 1102
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 1102
title: Windows Event ID 1102
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 1102
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1070.001Indicator Removal: Clear Windows Event Logs

Detection Notes

T1070.001 is high confidence when Event ID 1102 follows wevtutil.exe cl Security or Clear-EventLog in 4688 under the same Subject Logon ID. Security log clearing has no universal volume threshold: one unexpected clear on a domain controller or server is an incident. Use a local correlation window=60 minutes before the clear to review process creation, logon, and audit-policy changes, and preserve forwarded copies because the local retention window is destroyed.

Common False Positives

  • Authorized maintenance or log-retention workflows may clear logs, although this is uncommon for Security logs.
  • Lab rebuilds and forensic test procedures can generate intentional clears.

Related Events

Sample Log

Sanitized event sample
Subject: Account Name: CORP\admin.ops
Logon ID: 0x8e2c
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 1102 mean?

Event ID 1102 records that the Windows Security audit log was cleared. Microsoft documents it as an event generated whenever the Security log is cleared, regardless of the configured system audit policy.

Is Event ID 1102 always malicious?

No. Authorized maintenance and forensic testing can clear a log, but an unexpected Security-log clear is high priority because it removes local audit history.

How should Event ID 1102 be investigated?

Join SubjectLogonId to logon and process-creation records, identify the clearing process, and preserve forwarded or centralized copies of the events that preceded the clear.

Sources