What happened

The file {{ @file.path }} was deleted by the process {{ @process.comm }}. This may have been done to hide evidence.

Goal

Detect the removal of system log files in order to hide evidence of malicious activity.

Strategy

Monitor the file system for the deletion of specific system logs.

Triage and response

1. Review the signal to understand how the file {{ @file.path }} was deleted.
2. If the activity is malicious, isolate the affected host to prevent further compromise.
3. Use related signals and other logs to find and repair the root cause.

Requires Agent version 7.27 or later.