Evidence hidden by deleting system log file

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1070-indicator-removal

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

What happened

The file {{ @file.path }} was deleted by the process {{ @process.comm }}. This may have been done to hide evidence.

Goal

Detect the removal of system log files in order to hide evidence of malicious activity.

Strategy

Monitor the file system for the deletion of specific system logs.

Triage and response

  1. Review the signal to understand how the file {{ @file.path }} was deleted.
  2. If the activity is malicious, isolate the affected host to prevent further compromise.
  3. Use related signals and other logs to find and repair the root cause.

Requires Agent version 7.27 or later.