TechKnowSurge

VideoSecurityFree

Removed Evidence

Gaps in log files and deleted evidence can signal that an attacker has compromised a system and attempted to cover their tracks. Identifying these anomalies is a critical step in incident detection and response.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Attackers who successfully breach a system often take steps to cover their tracks, and one of the most common methods is deleting log files or removing other evidence of their activity. This means that missing or incomplete logs are not just a recordkeeping issue — they can be a meaningful signal that a compromise has occurred and should be treated as a potential indicator of attack. Consider a security service that logs a status check every second under normal operating conditions. If the log record suddenly shows a gap of five minutes or more, something interrupted that process. The explanation could be routine — a scheduled restart, a brief application outage, or a configuration change — but it could also mean an attacker gained access, carried out malicious activity, and then deleted the relevant log entries before exiting the system. Distinguishing between benign and malicious causes requires deeper investigation into the surrounding context: system event logs, authentication records, network traffic, and any other available telemetry from the same timeframe. This kind of forensic analysis is central to incident response, and the ability to recognize removed evidence as a red flag is a foundational competency for anyone working in cybersecurity operations or threat hunting.

What you'll learn

Identify gaps or missing log entries as potential indicators of compromise resulting from evidence tampering or log deletion

What's covered

Covering Tracks via Log Deletion

Adversary Log Removal
- Deleting log files
- Removing other evidence
Log Gap Anomaly Example
- Security service checks
  - Runs every second
- Five-minute gap detected
Possible Gap Causes
- Server restart
- Application turned off
- Attacker covered tracks
Indicator of Compromise
- Removed evidence flagged
- Further research required

Key terms

Log Management: The process of collecting, storing, analyzing, and monitoring log data generated by systems and applications.
Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Integrity: The assurance that data has not been tampered with and remains accurate and complete.
Threat Actor: An individual or group responsible for a security incident or attack.
Incident Response: A structured process for identifying, containing, eradicating, and recovering from security incidents.

Topics

Log Analysis Incident Response Evidence Tampering Log Deletion Indicators Of Compromise Digital Forensics

Transcript

Another thing that an adversary could be doing to cover their tracks is delete log files and remove other evidence. So that's another sign that we're going to be looking for, to see if there's any compromise or an attack on our system.

So for our example here, we're going to say that there's some logs that are being performed on some sort of device here. There's a security service check that's performed, and it flags whether there's concerns or no concerns, and we can see that it's doing it every minute, or every second actually. So every second it's happening, and then here we suddenly have a five minute gap, a more than a five minute gap.

So something happened here, but what happened? What was the anomaly caused by? Did somebody do a restart on the server? Did somebody turn the application off for a little bit? Or maybe somebody was trying to perform a hack on the system, did compromise the system, did the attack on it, and then covered their evidence by going in and deleting these logs. And so now we need to further research into this to figure out what happened on the system. So this could be an indicator of a compromise when there's removed evidence.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →