Indicator Removal

Adversaries may delete or alter artifacts generated during an intrusion to remove evidence of their presence or hinder incident response.

• Centralized logging
• Write-once log storage
• File integrity monitoring
• Backup critical logs

• Monitor for log clearing events
• Detect timestamp manipulation
• Track file deletions in sensitive areas