Windows Security 1102 — Security audit log cleared
Windows Security 1102 — Security audit log cleared. The Windows Security log was cleared.
Source and collection
Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.
Configure Audit-log clearing. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.
Native example and provenance
publisher documentation example. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — preformatted example 1
Removed Event Viewer tree expansion markers before XML tags; field values unchanged.
Download the exact sample · Offline research kit
SHA-256: 25f890259cbfb03d70d4fc3ac42600b0bb2faf32fef782e4bd7caf3f4868a8c9
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
<EventID>1102</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>104</Task>
<Opcode>0</Opcode>
<Keywords>0x4020000000000000</Keywords>
<TimeCreated SystemTime="2015-10-16T00:39:58.656871200Z" />
<EventRecordID>1087729</EventRecordID>
<Correlation />
<Execution ProcessID="820" ThreadID="2644" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
<UserData>
<LogFileCleared xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
<SubjectUserSid>S-1-5-21-3457937927-2839227994-823803824-1104</SubjectUserSid>
<SubjectUserName>dadmin</SubjectUserName>
<SubjectDomainName>CONTOSO</SubjectDomainName>
<SubjectLogonId>0x55cd1d</SubjectLogonId>
</LogFileCleared>
</UserData>
</Event>
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
Microsoft-Windows-Eventlog | XML text |
EventID | XML text |
Version | XML text |
Level | XML text |
Task | XML text |
Opcode | XML text |
Keywords | XML text |
TimeCreated | XML text |
EventRecordID | XML text |
Correlation | XML text |
Execution | XML text |
Channel | XML text |
Computer | XML text |
Security | XML text |
SubjectUserSid | XML text |
SubjectUserName | XML text |
SubjectDomainName | XML text |
SubjectLogonId | XML text |
- System/EventID
- Event identifier within the named provider.
- System/Version
- Version of this event layout.
- System/TimeCreated/@SystemTime
- Event timestamp in UTC.
- EventData
- Named fields; use names, not positional array indices.
- Relevant fields
- SubjectUserName, SubjectDomainName, SubjectLogonId
Investigation uses
- Check the clearing account, maintenance window and continuity of forwarded records.
- Compare event time with ingestion time and retain the original XML for a reviewable evidence trail.
Validation boundaries
Clearing can be authorized maintenance; the local log cannot reconstruct records already removed. This sample uses event version 0.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.