mirror of
https://github.com/valitydev/atomic-threat-coverage.git
synced 2024-11-06 17:45:23 +00:00
48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
title: DN_0050_1102_audit_log_was_cleared
|
|
description: >
|
|
This event generates every time Windows Security audit log was cleared
|
|
loggingpolicy:
|
|
- None
|
|
references:
|
|
- https://github.com/MicrosoftDocs/windows-itpro-docs/blob/master/windows/security/threat-protection/auditing/event-1102.md
|
|
category: OS Logs
|
|
platform: Windows
|
|
type: Windows Log
|
|
channel: Security
|
|
provider: Microsoft-Windows-Eventlog
|
|
fields:
|
|
- EventID
|
|
- Computer
|
|
- Hostname # redundant
|
|
- SubjectUserSid
|
|
- SubjectUserName
|
|
- SubjectDomainName
|
|
- SubjectLogonId
|
|
sample: |
|
|
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
|
- <System>
|
|
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
|
|
<EventID>1102</EventID>
|
|
<Version>0</Version>
|
|
<Level>4</Level>
|
|
<Task>104</Task>
|
|
<Opcode>0</Opcode>
|
|
<Keywords>0x4020000000000000</Keywords>
|
|
<TimeCreated SystemTime="2015-10-16T00:39:58.656871200Z" />
|
|
<EventRecordID>1087729</EventRecordID>
|
|
<Correlation />
|
|
<Execution ProcessID="820" ThreadID="2644" />
|
|
<Channel>Security</Channel>
|
|
<Computer>DC01.contoso.local</Computer>
|
|
<Security />
|
|
</System>
|
|
- <UserData>
|
|
- <LogFileCleared xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
|
|
<SubjectUserSid>S-1-5-21-3457937927-2839227994-823803824-1104</SubjectUserSid>
|
|
<SubjectUserName>dadmin</SubjectUserName>
|
|
<SubjectDomainName>CONTOSO</SubjectDomainName>
|
|
<SubjectLogonId>0x55cd1d</SubjectLogonId>
|
|
</LogFileCleared>
|
|
</UserData>
|
|
</Event>
|