medium10 pts · first answer countswindows-event-logsmitre-attack
Security log cleared on a server
Event ID 1102 "The audit log was cleared" appears on a file server at 03:14, shortly after an unusual admin logon. How should you treat it?
Discussion 0
Join free to post in the discussion.
Related questions
- What is Windows Event ID 4624?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- Tactic vs technique in MITRE ATT&CKCybersecurity Analyst
- Reading the logon typeCybersecurity Analyst
- A suspicious scheduled taskCybersecurity Analyst
- A good threat hunting hypothesisCybersecurity Analyst
- Detecting DCSyncCybersecurity Analyst
- A living-off-the-land downloadCybersecurity Analyst