Detection rules › By event

Microsoft-Windows-Eventlog

Event	Rules
Event ID 104	6
Event ID 517	2
Event ID 1100	1
Event ID 1102	8

Event ID 104

6 detection rules reference this event. View event page.

Sigma (3)

Event log cleared (native) severity high T1070, T1685.005
Eventlog Cleared severity medium T1685, T1685.005
Important Windows Eventlog Cleared severity high T1685, T1685.005

Elastic (1)

Windows Event Logs Cleared severity low T1070, T1685.005

Splunk (2)

Clear Windows Event Logs (Windows Event Log) T1070, T1685.005
Windows Event Log Cleared severity medium T1685, T1685.005

Event ID 517

2 detection rules reference this event. View event page.

Sigma (1)

Security Eventlog Cleared severity high T1685, T1685.005

Splunk (1)

Clear Windows Event Logs (Windows Event Log) T1070, T1685.005

Event ID 1100

1 detection rules reference this event. View event page.

Splunk (1)

Windows Event Logging Service Has Shutdown T1685, T1685.005

Event ID 1102

8 detection rules reference this event. View event page.

Sigma (2)

Event log cleared (native) severity high T1070, T1685.005
Security Eventlog Cleared severity high T1685, T1685.005

Elastic (1)

Windows Event Logs Cleared severity low T1070, T1685.005

Splunk (2)

Clear Windows Event Logs (Windows Event Log) T1070, T1685.005
Windows Event Log Cleared severity medium T1685, T1685.005

Kusto (2)

NRT Security Event log cleared severity medium T1070
Security Event log cleared severity medium T1070

YARA-L (1)

Windows Event Log Cleared severity medium T1070, T1685.005