Host Log Modification

A subject intentionally alters host-based log records to conceal, misattribute, or misrepresent activity conducted on an endpoint, server, or other operating system.

The subject may change timestamps, account names, event identifiers, source addresses, command details, or action outcomes within Windows Event Logs, Linux system or audit logs, macOS logs, security-agent logs, or other locally stored records. Modification may be performed using administrative tools, scripts, third-party log scrubbers, or direct access to .evtx, .log, or other log files.

Investigators should compare local records with centrally forwarded logs, Endpoint Detection and Response (EDR) telemetry, process execution records, file metadata, and File Integrity Monitoring (FIM) events. This Sub-section applies where log content is altered but the record or log remains present.