Linux Log Clearing Attempts via Common Utilities

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

Attackers often remove or modify system logs to hide their actions and hinder forensic investigations. This activity involves the use of common Linux utilities to delete or overwrite log files, making it difficult to trace the attacker’s entry point, lateral movement, and actions performed on the system. Log clearing is a common post-exploitation technique used by a wide range of threat actors across various campaigns. This brief focuses on detecting the usage of common utilities like rm…

Log-Clearing — CraftedSignal Threat Feed

Linux Log Clearing Attempts via Common Utilities