Windows Event ID 808 – Security: Audit Log Cleared

Start by examining the specific details of the Event ID 808 occurrence to understand who cleared the logs and when.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 808 by right-clicking the Security log and selecting Filter Current Log
4. Enter 808 in the Event IDs field and click OK
5. Double-click the Event ID 808 entry to view detailed information
6. Review the General tab for timestamp and basic details
7. Check the Details tab for user SID, logon session, and process information
8. Document the User, Computer, and Event Time for investigation purposes

Use PowerShell to retrieve comprehensive information about all Event ID 808 occurrences and analyze patterns.

1. Open PowerShell as Administrator
2. Run the following command to retrieve all Event ID 808 occurrences:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=808} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. For more detailed analysis, export the events to CSV:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=808} | Select-Object TimeCreated, Id, UserId, ProcessId, Message | Export-Csv -Path "C:\Temp\Event808_Analysis.csv" -NoTypeInformation

4. To check events from the last 30 days:

   $StartDate = (Get-Date).AddDays(-30)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=808; StartTime=$StartDate} | Format-Table TimeCreated, Message -AutoSize

5. Extract user information from the events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=808} | ForEach-Object { [xml]$xml = $_.ToXml(); $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object '#text' }

Analyze the user account and logon session information to determine if the log clearing was performed by authorized personnel.

1. From the Event ID 808 details, note the Subject User Name and Subject Domain
2. Verify the user account exists and has appropriate permissions:

   Get-ADUser -Identity "username" -Properties MemberOf, LastLogonDate, PasswordLastSet | Select-Object Name, SamAccountName, MemberOf, LastLogonDate, PasswordLastSet

3. Check if the user is a member of privileged groups:

   Get-ADUser -Identity "username" -Properties MemberOf | Select-Object -ExpandProperty MemberOf | Get-ADGroup | Where-Object {$_.Name -match "Admin|Operator|Backup"}

4. Review concurrent logon events around the time of log clearing:

   $EventTime = (Get-Date "2026-03-17 10:30:00") # Replace with actual event time
   $TimeWindow = 30 # minutes
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$EventTime.AddMinutes(-$TimeWindow); EndTime=$EventTime.AddMinutes($TimeWindow)} | Where-Object {$_.Message -match "username"}

5. Check for any Group Policy or scheduled task that might have triggered the clearing:

   Get-ScheduledTask | Where-Object {$_.Actions.Execute -match "Clear-EventLog|wevtutil"} | Select-Object TaskName, State, LastRunTime

Implement additional monitoring and alerting mechanisms to detect future log clearing activities and strengthen audit trail integrity.

1. Enable advanced audit policy for object access to track Event Viewer usage:

   auditpol /set /subcategory:"File System" /success:enable /failure:enable
   auditpol /set /subcategory:"Registry" /success:enable /failure:enable

2. Configure Windows Event Forwarding to send Event ID 808 to a central collector:

   # On the collector server
   wecutil qc /q
   # On source computers
   winrm qc -q

3. Create a scheduled task to alert on Event ID 808 occurrences:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command \"Send-MailMessage -To 'security@company.com' -From 'alerts@company.com' -Subject 'Security Log Cleared' -Body 'Event ID 808 detected' -SmtpServer 'mail.company.com'\""
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries
   Register-ScheduledTask -TaskName "SecurityLogClearAlert" -Action $Action -Trigger $Trigger -Settings $Settings

4. Configure Event Log retention policies to prevent automatic clearing:

   # Set Security log to 1GB with overwrite as needed
   wevtutil sl Security /ms:1073741824 /rt:true

5. Implement PowerShell script logging to capture any Clear-EventLog commands:

   # Enable PowerShell module logging via Group Policy or registry
   New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1 -PropertyType DWORD -Force
   New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames" -Name "*" -Value "*" -PropertyType String -Force

Perform comprehensive forensic analysis when Event ID 808 indicates potential security incidents or unauthorized log tampering.

1. Create a forensic timeline of events surrounding the log clearing:

   # Export all security events from 24 hours before the incident
   $IncidentTime = (Get-Date "2026-03-17 10:30:00") # Replace with actual time
   $StartTime = $IncidentTime.AddHours(-24)
   $EndTime = $IncidentTime.AddHours(1)
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime} | Export-Csv -Path "C:\Forensics\SecurityEvents_Timeline.csv" -NoTypeInformation

2. Check for evidence of lateral movement or privilege escalation:

   # Look for unusual logon patterns
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648,4672} | Where-Object {$_.TimeCreated -ge $StartTime -and $_.TimeCreated -le $EndTime} | Group-Object Id | Select-Object Name, Count

3. Analyze process execution events that might indicate malicious tools:

   # Check for suspicious process creation events
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object {$_.Message -match "wevtutil|Clear-EventLog|eventvwr" -and $_.TimeCreated -ge $StartTime}

4. Review file system access to Event Log files:

   # Check access to .evtx files in System32\winevt\Logs
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656,4658} | Where-Object {$_.Message -match "\.evtx" -and $_.TimeCreated -ge $StartTime}

5. Generate a comprehensive incident report:

   # Create incident summary
   $Report = @{
       IncidentTime = $IncidentTime
       ClearingUser = "Extract from Event 808"
       ConcurrentEvents = (Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime}).Count
       SuspiciousProcesses = "List any unusual processes"
       RecommendedActions = "Immediate containment and investigation steps"
   }
   $Report | ConvertTo-Json | Out-File "C:\Forensics\Event808_IncidentReport.json"