---
tags:
  - CrowdStrike
  - Event Logs
  - Linux
  - macOS
  - T1070.001
  - T1070.002
  - Windows

hide:
  - navigation
  - tags
---

# Were any system event logs cleared?

**ID**: Q1074


**Approaches to Answer**

-  [Search CrowdStrike logs for indicator removal on host [Q1074.10]](#search-crowdstrike-logs-for-indicator-removal-on-host)
    - CrowdStrike has built-in detections for "indicator removal on host" events.
    - Tags: <span class="dfiqTag">CrowdStrike</span> <span class="dfiqTag">Linux</span> <span class="dfiqTag">Windows</span> <span class="dfiqTag">macOS</span>
-  [Examine Windows Event Logs for Audit Log cleared [Q1074.11]](#examine-windows-event-logs-for-audit-log-cleared)
    - Parse the Windows Security Event Log and look for "the audit log was cleared" event.
    - Tags: <span class="dfiqTag">Windows</span> <span class="dfiqTag">Event Logs</span>

# Approaches

!!! Note
    There are often multiple ways to approach answering a question.
    This section explains the approaches considered, how they work, and any
    benefits or drawbacks to each. All these approaches have different pros
    and cons. They can be used individually or in conjunction.

## Search CrowdStrike logs for indicator removal on host
### 🗂️ Explanation
Clearance/deletion of system logs would be recorded in CrowdStrike as a part of their "indicator removal on host" detections.

#### References
 - https://www.crowdstrike.com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/
 - [Indicator Removal on MITRE ATT&CK](https://attack.mitre.org/techniques/T1070/)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - CrowdStrike's built-in detection for "indicator removal on host" events.

!!! failure "Not Covered"

     - CrowdStrike may not have all log clear/delete events as part of this detection.


### 💾 Data

The following data source(s) are needed for this approach to the question.


  - CrowdStrike: PlatformEvents

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Splunk"
    More information on [Splunk](https://forensics.wiki/splunk).


    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Splunk's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    Splunk-Query

    1. Query searching for indicator removal on host events.
      - Type: splunk-query
      - Value: ComputerName="{hostname}" Technique="Indicator Removal on Host"

## Examine Windows Event Logs for Audit Log cleared
### 🗂️ Explanation
On Windows systems, log clearance events for Security event log will be logged with event ID 1102. The logs contain the actor account name, domain name, logon id fields.

#### References
 - [1102(S): The audit log was cleared.](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102)
 - [Indicator Removal: Clear Windows Event Logs on MITRE ATT&CK](https://attack.mitre.org/techniques/T1070/001/)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - Security event log clearance events on Windows systems.

!!! failure "Not Covered"

     - If the log is deleted or otherwise altered, this event may not be logged.
     - Only applies to Windows Security audit logs.


### 💾 Data

The following data source(s) are needed for this approach to the question.

**Description**
:  Windows Event Log files


**Type**
:  [ForensicArtifact](https://github.com/ForensicArtifacts/artifacts#digital-forensics-artifacts-repository)

**Value**
:  WindowsEventLogs ([view on GitHub](https://github.com/ForensicArtifacts/artifacts/search?q=WindowsEventLogs))

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Plaso"
    More information on [Plaso](https://forensics.wiki/plaso).

    Recommended options:

    ```
     --parsers winevtx
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Plaso's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to events containing audit log clearance.
       - OpenSearch query:

         ```
         data_type:"windows:evtx:record" event_identifier:1102 source_name:"Microsoft-Windows-Security-Auditing"
         ```
