Tomcat WebServer Logs Deleted
Detects the deletion of Apache Tomcat web server logs, which could indicate an adversary attempting to remove forensic evidence of their activities on the server. The rule specifically looks for deletion events targeting files within paths containing '\Tomcat\logs\' and filenames matching common Tomcat log patterns like 'catalina.', '_access_log.', or 'localhost.'.
Sigma
