Event ID 1102: security audit log cleared

Event ID 1102 means the Security log was cleared, and it records who did it. Logs don't normally get cleared: they roll over on their own. So a 1102 on a server almost always deserves a question, and attackers clear logs to hide what came before.

The fields that matter

What is normal

An admin clearing a test machine, or troubleshooting with a documented change.

When Event ID 1102 is suspicious

• Any 1102 on a domain controller or production server without a change record.
• A clear soon after suspicious activity, such as new services, new accounts or unusual logons.
• Clears by accounts that don't normally administer that host, or the System log cleared too (System Event ID 104).

Find Event ID 1102 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 1102
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated desc

Related events

• System Event ID 104: Event log cleared
• Event ID 4719: System audit policy changed
• Event ID 4624: Successful logon

FAQ

How was the log cleared?

Usually with wevtutil cl Security, PowerShell Clear-EventLog or Event Viewer. 4688 or Sysmon 1 just before the 1102 often shows the command.

Can I still find what happened before the clear?

Check copies outside the machine: your SIEM, forwarded events, EDR telemetry and logs on other hosts the attacker touched.