CAPEC-571: Block Logging to Central Repository
Description
An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Low
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate System Resources
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-RKDRegistry Key Deletion1 shared
- D3-SYSVASystem Vulnerability Assessment1 shared
- D3-SDMSystem Daemon Monitoring1 shared
- D3-ACHApplication Configuration Hardening1 shared
- D3-DRADisable Remote Access1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
- D3-NNINetwork Node Inventory1 shared
- D3-PLMPhysical Link Mapping1 shared
- D3-SICASystem Init Config Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared