Detecting Windows Security Event Logs Cleaned
Query
DeviceEvents
| where ActionType has "SecurityLogCleared"About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1070.001 | Indicator Removal: Clear Windows Event Logs |
Author: Sergio Albea (20/01/2025)
Detecting Windows Security Event Logs Cleaned
Description: This KQL query below will help you detect cases where Windows Security Event Logs, has been removed directly using Event Viewer. Among the potential mitigations and associated threats, we have:
šš”š«ššš š¦š¢šš¢š ššš¢šØš§š¬: ā Restrict access to Device Logs ā Audit access to Device Logs ā Backup Device Logs
šš”š«šššš¬ šš¬š¬šØšš¢šššš: ā Lost of non-reputation evidence ā Lack of visibility over malicious activities ā Regulatory Non-Compliance
Explanation
This query is designed to help detect instances where Windows Security Event Logs have been cleared using the Event Viewer. It focuses on identifying actions that indicate the removal of these logs, which can be a sign of malicious activity attempting to cover its tracks.
Key Points:
- Purpose: To identify when Windows Security Event Logs are cleared, which could indicate an attempt to hide malicious activities.
- Technique Used: The query looks for events where the action type includes "SecurityLogCleared."
- Potential Mitigations:
- Restrict and audit access to device logs to prevent unauthorized log clearing.
- Regularly back up device logs to ensure data is not lost.
- Associated Threats:
- Loss of important evidence that could be used for investigations.
- Reduced ability to monitor and respond to malicious activities.
- Potential non-compliance with regulatory requirements due to missing logs.
In simple terms, this query helps security teams spot when someone might be trying to erase evidence of their actions on a Windows system by clearing the security logs.
