Glossary: Network Attacks, Social Engineering and Indicators

log manipulation

Also written: log tampering, Indicator Removal, T1070

Deleting, editing, stopping or flooding logs to hide malicious activity. Signs include event 1102, logs that are suddenly empty, and gaps in logs that normally write at a steady rhythm.