Technique
№ 043 · class: evasion
Log Tampering
Deleting, modifying, or disabling logs to hide activity.
Term
description · examples · notesDeleting, modifying, or disabling logs to hide activity.
Description
Targets Windows Event Log, syslog, web server logs, and SIEM sources.
Can delete specific entries or completely disable the logging service.
Hinders incident response and forensic analysis.
Detection requires centralized logging on a protected server.
Examples
- wevtutil cl for clearing Windows Event logs
- Deleting .bash_history on Linux systems
Notes
- This is why centralized logging (SIEM) is key — local logs are unreliable.
Threats
used by 3Threats that use it. Select one to open its page.
Defenses
countered by 4How it is countered. Select one to open its page.