Detection of Web Server Access Log Deletion

Adversaries frequently target web server access logs during the post-exploitation phase to cover their tracks and impede incident response. By deleting these files, attackers aim to destroy records of their initial access, C2 communication, or internal reconnaissance activities. This behavior is cross-platform, affecting common web server architectures including Microsoft IIS, Apache, and HTTPd. Detection engineering teams should monitor for file deletion events occurring within standard directory paths dedicated to log storage. While this activity is often malicious, defenders must differentiate between attacker-led indicator removal and routine administrative tasks such as log rotation, automated backups, or environment resets.

Attack Chain

1. Attacker gains unauthorized access to a web server via exploit or credential misuse.
2. Attacker executes commands to explore the file system and locate web server log directories.
3. Attacker identifies the specific log files that record their malicious activities.
4. Attacker issues delete commands (e.g., 'del' on Windows or 'rm' on Linux/macOS) to target the log files.
5. The OS records a 'file deletion' event within the EDR or system logging subsystem.
6. Security tools trigger an alert based on the file path matching web server log conventions.
7. Attacker continues unauthorized activity with reduced visibility for responders.

Impact

Successful deletion of web server access logs results in the permanent loss of critical forensic data required for determining the scope of a breach, identifying the attacker's IP address, and mapping the timeline of an incident. Without these logs, defenders may be unable to confirm if sensitive data was exfiltrated or which specific web application vulnerabilities were exploited, forcing a reliance on secondary, potentially less reliable telemetry.

Recommendation

• Deploy the detection rule below to identify unauthorized file deletion events targeting web server logs.
• Establish a baseline of authorized log rotation processes, backup scripts, and maintenance tasks; use these as filters to reduce noise.
• Audit access controls on web server log directories to restrict write and delete permissions to service accounts and authorized administrative roles only.
• Correlate log deletion alerts with preceding web server requests or unauthorized process executions to confirm malicious intent.