mirror of
https://github.com/valitydev/atomic-threat-coverage.git
synced 2024-11-06 09:35:21 +00:00
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
title: DN_0034_104_log_file_was_cleared
|
|
description: >
|
|
Windows log file was cleared
|
|
loggingpolicy:
|
|
- None
|
|
references:
|
|
- http://kb.eventtracker.com/evtpass/evtpages/EventId_104_Microsoft-Windows-Eventlog_64337.asp
|
|
category: OS Logs
|
|
platform: Windows
|
|
type: Windows Log
|
|
channel: System
|
|
provider: Microsoft-Windows-Eventlog
|
|
fields:
|
|
- EventID
|
|
- Computer
|
|
- Hostname # redundant
|
|
- SubjectUserName
|
|
- SubjectDomainName
|
|
- Channel # which was cleared; not generated for security channel
|
|
sample: |
|
|
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
|
- <System>
|
|
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
|
|
<EventID>104</EventID>
|
|
<Version>0</Version>
|
|
<Level>4</Level>
|
|
<Task>104</Task>
|
|
<Opcode>0</Opcode>
|
|
<Keywords>0x8000000000000000</Keywords>
|
|
<TimeCreated SystemTime="2019-02-08T22:31:47.796843000Z" />
|
|
<EventRecordID>7659</EventRecordID>
|
|
<Correlation />
|
|
<Execution ProcessID="752" ThreadID="1988" />
|
|
<Channel>System</Channel>
|
|
<Computer>ATC-WIN-7.atc.local</Computer>
|
|
<Security UserID="S-1-5-21-3463664321-2923530833-3546627382-1000" />
|
|
</System>
|
|
- <UserData>
|
|
- <LogFileCleared xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
|
|
<SubjectUserName>user1</SubjectUserName>
|
|
<SubjectDomainName>ATC-WIN-7.atc.local</SubjectDomainName>
|
|
<Channel>Application</Channel>
|
|
<BackupPath />
|
|
</LogFileCleared>
|
|
</UserData>
|
|
</Event>
|