Technique
technique:log_and_evidence_evasion
Also: covering tracks, wiping logs
Attempting to remove logs and other evidence after unauthorized access and destructive actions.
Attempting to remove logs and other evidence after unauthorized access and destructive actions.
“let’s try and get rid of as much as possible to try and cover my tracks”
“he wasn’t able to clear everything”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Academy network attack | Explicit | 113 |
| incoming | INVOLVES | Unnamed IT company network attack | Explicit | 113 |
Academy network attack INVOLVES log and evidence evasion
Adam attempted to cover his tracks by deleting logs and other evidence, although he could not access the firewall logs.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“let’s try and get rid of as much as possible to try and cover my tracks”
Unnamed IT company network attack INVOLVES log and evidence evasion
The later attack included uninstalling software and changing administrator passwords, actions that disrupted systems and limited access.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“he changed their passwords so they couldn’t log in anymore”