Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Log Clearing and Log Tampering

Log Clearing and Log Tampering

2 min read

Jump to:

Overview

Log clearing and log tampering are techniques used by adversaries to remove or alter evidence of their activities within system and security logs. These actions primarily serve to evade detection and hinder forensic investigations during various stages of an attack lifecycle. By manipulating logs, attackers aim to maintain stealth and prolong their presence within a compromised environment.

Attack Objective

Maintain stealth by erasing or altering audit trails
Supports Defense Evasion and Persistence stages of the attack lifecycle
Advances attacker position by reducing the likelihood of detection and complicating incident response efforts

How the Technique Works

Adversaries identify and target log files or logging mechanisms that record system, application, or security events. They then clear, delete, or modify these logs to remove traces of their actions, such as unauthorized access, privilege escalations, or lateral movements. This can involve direct manipulation of log files, disabling logging services, or using legitimate administrative tools to alter log data.

Common Methods & Variations

Clearing Windows Event Logs using built-in utilities or APIs
Modifying or deleting log files on Unix/Linux systems
Altering cloud service audit logs or disabling logging features
Using living-off-the-land binaries (LOLBins) such as PowerShell or native command-line tools to manipulate logs
Employing custom scripts or malware to automate log tampering

Indicators of Compromise (IOCs)

Unexpected gaps or missing entries in log timelines
Log size resets or sudden truncation events
Audit logs showing log clearing commands or service stoppages
Unusual access patterns to log files or logging services
Alerts from integrity monitoring systems indicating log file modifications

Detection Strategies

Monitoring system and security logs for irregularities or gaps
Behavioral detection of commands or processes associated with log clearing
Correlating multiple telemetry sources such as endpoint, network, and identity logs
Implementing alerting on log service stoppage or configuration changes
Using centralized log aggregation to detect inconsistencies across sources

Mitigation & Prevention

Implement strict access controls and least privilege principles for log management
Enable tamper-evident logging and write-once-read-many (WORM) storage for logs
Use centralized and immutable log collection systems
Regularly audit logging configurations and permissions
Deploy endpoint detection and response (EDR) solutions with monitoring for log manipulation behaviors

Response Considerations

Immediately preserve remaining logs and related artifacts for forensic analysis
Investigate the scope and timeline of log tampering to identify affected systems and actions
Review and harden logging configurations to prevent recurrence
Consider deploying additional monitoring and alerting mechanisms
Coordinate with incident response teams to assess impact and remediate compromised assets

Related Techniques

Defense Evasion techniques such as disabling security tools or clearing command history
Persistence methods that rely on stealth to maintain access
Privilege Escalation activities that may precede log tampering
Lateral Movement tactics that adversaries may try to hide through log manipulation

Mapping & References

MITRE ATT&CK T1070.001 – Indicator Removal on Host: Clear Windows Event Logs
MITRE ATT&CK T1070 – Indicator Removal on Host
Public advisories on log tampering detection and prevention from cybersecurity organizations
Incident reports highlighting log clearing as part of advanced persistent threat (APT) campaigns

Tags: Attack Lifecycle cyber threats Defense Evasion endpoint security Forensics Incident Response Log Clearing Log Tampering MITRE ATT&CK Security Monitoring