NRT Security Event log cleared
Id | 508cef41-2cd8-4d40-a519-b04826a9085f |
Rulename | NRT Security Event log cleared |
Description | Checks for event id 1102 which indicates the security event log was cleared. It uses Event Source Name “Microsoft-Windows-Eventlog” to avoid generating false positives from other sources, like AD FS servers for instance. |
Severity | Medium |
Tactics | DefenseEvasion |
Techniques | T1070 |
Required data connectors | SecurityEvents WindowsSecurityEvents |
Kind | NRT |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yaml |
Version | 1.0.0 |
Arm template | 508cef41-2cd8-4d40-a519-b04826a9085f.json |
SecurityEvent
| where EventID == 1102 and EventSourceName == "Microsoft-Windows-Eventlog"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity
kind: NRT
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yaml
name: NRT Security Event log cleared
entityMappings:
- entityType: Account
fieldMappings:
- columnName: Account
identifier: FullName
- entityType: Host
fieldMappings:
- columnName: Computer
identifier: FullName
relevantTechniques:
- T1070
severity: Medium
description: |
'Checks for event id 1102 which indicates the security event log was cleared.
It uses Event Source Name "Microsoft-Windows-Eventlog" to avoid generating false positives from other sources, like AD FS servers for instance.'
id: 508cef41-2cd8-4d40-a519-b04826a9085f
version: 1.0.0
tactics:
- DefenseEvasion
query: |
SecurityEvent
| where EventID == 1102 and EventSourceName == "Microsoft-Windows-Eventlog"
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity
status: Available
requiredDataConnectors:
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
- dataTypes:
- SecurityEvent
connectorId: WindowsSecurityEvents
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/508cef41-2cd8-4d40-a519-b04826a9085f')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/508cef41-2cd8-4d40-a519-b04826a9085f')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "NRT",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "NRT Security Event log cleared",
"description": "'Checks for event id 1102 which indicates the security event log was cleared.\nIt uses Event Source Name \"Microsoft-Windows-Eventlog\" to avoid generating false positives from other sources, like AD FS servers for instance.'\n",
"severity": "Medium",
"enabled": true,
"query": "SecurityEvent\n| where EventID == 1102 and EventSourceName == \"Microsoft-Windows-Eventlog\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), EventCount = count() by Computer, Account, EventID, Activity\n",
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion"
],
"techniques": [
"T1070"
],
"alertRuleTemplateName": "508cef41-2cd8-4d40-a519-b04826a9085f",
"customDetails": null,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "Account"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "Computer"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_SecurityEventLogCleared.yaml",
"templateVersion": "1.0.0",
"status": "Available"
}
}
]
}