AN1472
Analytic 1472
Windows
Detects behavioral sequence where an adversary gains elevated privileges and clears event logs using native binaries (e.g., wevtutil), PowerShell, or direct file deletion of .evtx files.
WinEventLog:Security
EventCode=1102
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=23
[TimeWindow]
Time range between log-clearing command and 1102 event; tunable to reduce false positives
[UserContext]
Filter by admin/elevated users; allow tuning to detect abuse of high-privilege accounts
[CommandLinePattern]
Match common variations of log-clearing commands like `Remove-EventLog`, `wevtutil cl`
[TargetLogName]
Scope detection to Security, System, Application, or custom logs based on environment