NRT Security Event log cleared

Status: available
Severity: medium
Group by: Account, Activity, Computer, EventID
Source: github.com/Azure/Azure-Sentinel

Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS servers for instance.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070` Indicator Removal

Telemetry coverage

Provider	Record / event type
Eventlog	Event ID 1102: The audit log was cleared.

Rule body

id: 508cef41-2cd8-4d40-a519-b04826a9085f
name: NRT Security Event log cleared
description: |
  'Checks for event id 1102 which indicates the security event log was cleared.
  It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS servers for instance.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1070
query: |
  SecurityEvent
  | where EventID == 1102 and EventSourceName == "Microsoft-Windows-Eventlog"
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.1
kind: NRT

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

| where EventID == 1102 and EventSourceName == "Microsoft-Windows-Eventlog"

Stage 3: `summarize`

| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity

Stage 4: `extend` (3 consecutive steps)

| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventID`	eq	`1102` corpus 4 (splunk 2, kusto 2)	`field:"EventID" kind:eq value:"1102"`
`EventSourceName`	eq	`Microsoft-Windows-Eventlog`	`field:"Category" kind:eq value:"Microsoft-Windows-Eventlog"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Account`	`summarize`
`Activity`	`summarize`
`Computer`	`summarize`
`EndTimeUtc`	`summarize`
`EventCount`	`summarize`
`EventID`	`summarize`
`StartTimeUtc`	`summarize`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountNTDomain`	`extend`
`AccountName`	`extend`