Evidence hidden by deleting system log file

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1070-indicator-removal

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect the removal of system log files such as in order to hide evidence of malicious activity.

Strategy

Monitor the file system for the deletion of specific system logs such as /var/log/syslog.

Requires Agent version 7.27 or later.