StandardCAPEC-268
CAPEC-268: Audit Log Manipulation
Description
The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The target host is logging the action and data of the user.
- The target host insufficiently protects access to the logs or logging mechanisms.
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1070Indicator Removal
- T1562.002Impair Defenses: Disable Windows Event Logging
- T1562.003Impair Defenses: Impair Command History Logging
- T1562.008Impair Defenses: Disable or Modify Cloud Logs
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
- D3-FEVFile Eviction2 shared
- D3-FIMFile Integrity Monitoring2 shared
- D3-LFPLocal File Permissions2 shared
- D3-RFAMRemote File Access Mediation2 shared
- D3-RFRestore File2 shared
- D3-CQContent Quarantine2 shared
- D3-RKDRegistry Key Deletion1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-002User Activity from Clearing Event Logs1 shared
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2020-11-005Clear Powershell Console Command History1 shared
- CAR-2020-11-007Network Share Connection Removal1 shared
- CAR-2021-01-003Clearing Windows Logs with Wevtutil1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared