Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| chronicle | Chronicle | technique_scores | T1070 | Indicator Removal on Host |
Comments
Chronicle is able to trigger an alert when logs are cleared from the infrastructure.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_log_deletion.yaral
References
|
| security_command_center | Security Command Center | technique_scores | T1070 | Indicator Removal on Host |
Comments
SCC is able to detect when audit logging has been disabled for a resource. Adversaries may use this weakness to hide their activity and remove evidence of their presence (e.g., clear command history, clear logs, file deletion). This technique was graded as significant due to the high detect coverage and real-time temporal factor.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1070.002 | Clear Linux or Mac System Logs | 1 |
| T1070.001 | Clear Windows Event Logs | 1 |
| T1070.004 | File Deletion | 1 |
| T1070.006 | Timestomp | 1 |