Indicator-Removal

Adversaries use the Windows 'rmdir' utility with recursive and quiet flags to systematically purge forensic artifacts, malware components, and temporary directories to hinder incident response efforts.

Detection of web server access log deletion across Windows, Linux, and macOS systems indicates potential defense evasion and destruction of forensic evidence by threat actors.