Detect Indicator Removal on Host
Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however, standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to a lack of sufficient data to determine what occurred.
Tactic: Defense Evasion
Platform: Linux, Windows, macOS
Data Sources: API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Defense Bypassed: Anti-virus, Host intrusion prevention systems, Log analysis
Mitigation of Indicator Removal on Host
Encrypt Sensitive Information: Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Remote Data Storage: Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Restrict File and Directory Permissions: Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.
The resource of Deobfuscate/Decode Files or Information with this free Splunk Detection Rule:
index=windows source=”WinEventLog:Microsoft-Windows-Sysmon/Operational” (EventCode=1 Image=”\\wevtutil.exe” CommandLine=”*cl”) OR (EventCode=1 Image=”\\fsutil.exe” CommandLine=”*usn deletejournal”) \\deleting logs on windows
index=windows source=”WinEventLog:Microsoft-Windows-PowerShell/Operational” (EventCode=4104 Message=”Clear-Eventlog”) //delete windows events with powershell cmdlet