// REFERENCE
104 — Event log was cleared
Log: System
High risk
An event log other than Security was cleared (e.g. System or an operational log), from the EventLog provider. Like 1102, it points to evasion and evidence destruction. Note which log was cleared and by whom.
Related tools
Work with this in:
Related
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.