// REFERENCE
1102 — The audit log was cleared
Log: Security
High risk
The Security log was cleared. Barring planned maintenance, clearing the Security log is an almost unmistakable anti-forensics signal: the attacker is trying to destroy evidence. It should trigger an immediate alert.
Related tools
Work with this in:
Related
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.