Question

During an incident review, an analyst notices that a Windows workstation generated Security Event ID 1102 at 03:14 AM, followed by a gap in logged events until 03:47 AM. The workstation's user was not scheduled to work overnight, and an EDR alert had flagged a suspicious PowerShell process on the same host minutes earlier. Which conclusion is BEST supported by these observations?

Accepted Answer

An adversary likely cleared the audit log to destroy evidence of their activity, consistent with an anti-forensics defense evasion technique

Answer

The workstation experienced NTP drift, causing a normal gap in the event timeline

Answer

A scheduled Windows Update forced a reboot that automatically purged old event logs

Answer

The SIEM forwarder failed, so events during that window were never collected from the host