Glossary: Network Attacks, Social Engineering and Indicators

Windows event IDs (1102, 104, 1100)

Also written: event ID 1102, 1102, The audit log was cleared, event ID 104, 104, The log file was cleared, event ID 1100, 1100

Windows event numbers that reveal log manipulation: 1102 means the Security log was cleared (and names the account that did it), 104 means another log was cleared, and 1100 means the event logging service shut down. Event 1100 is also written at normal shutdowns, so it matters only when no shutdown matches it.