Operation Poisson T1070: Event Log and Audit Log Clearing Post-Intrusion
This rule detects various techniques used by an adversary to clear, truncate, or delete system and audit logs to hide their activity. It monitors for commands targeting Windows Event Logs (wevtutil, Clear-EventLog), Linux system logs (/var/log/ via rm/shred), and journalctl vacuuming, as well as the deletion of .evtx files. It further enriches these detections by identifying if the process was spawned by suspicious parent processes often associated with remote access, lateral movement, or command-and-control activity.
Cortex XDR
