[WINDOWS-SYSTEM] The Application log file was cleared

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSTEM] The Application log file was cleared"; program:*System*; json_map:"message",".Message"; json_map:"event_id",".EventID"; event_id:104; content:"The Application log file was cleared"; classtype:trojan-activity; sid:5013577; rev:1; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_07_05, updated_at 2023_07_05, mitre_tactic_id TA0005, mitre_technique_id T1070.001;)