Elastic low stable kql

Windows Event Logs Cleared

Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.

View Source

Detection Logic

host.os.type:windows and event.action:("audit-log-cleared" or "Log clear") and
  winlog.channel: ("Security" or "System")

Field Validations

Loading…

Comments (0)

Loading comments...