Anti-Forensics
Account Misuse
Audit Trail Saturation
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Cross-System Activity Fragmentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disable Logging
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Incremental Data Collection
Log Deletion
Log Modification
Message Deletion
Message Modification
Modify Windows Registry
Network Obfuscation
Parent Process ID Spoofing
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Retention Window Exploitation
Rootkit
Stalling
Steganography
System Shutdown
System Time Modification
Timestomping
Tripwires
Trusted Tool Misuse
Uninstalling Software
Virtualization
- ID: AF026
- Created: 04th August 2025
- Updated: 05th August 2025
- Contributor: The ITM Team
Log Modification
The subject intentionally alters or removes log entries, either at the host, application, or network level, in a deliberate attempt to conceal or misrepresent their actions. This behavior is typically executed to frustrate forensic reconstruction during an investigation and may include deletion of individual log lines, rewriting timestamps, or manipulating source IPs or usernames.
Subjects engaging in this technique may use native administrative tools (e.g., PowerShell, auditpol, journalctl), third-party log scrubbers, or direct file system access to tamper with .evtx, .log, or flat text logs.
Subsections (4)
| ID | Name | Description |
|---|---|---|
| AF026.002 | Application Log Modification | A subject intentionally alters audit, authentication, access, transaction, or administrative records generated by an organizational application to conceal or misrepresent activity conducted through that application.
The subject may change the recorded actor, timestamp, source address, action, affected object, approval state, or result. Modification may be performed through application administration functionality, an Application Programming Interface (API), direct database access, scripts, or access to the underlying log repository.
Investigators should compare application records with identity logs, database activity, endpoint telemetry, web proxy records, workflow history, and relevant business records. |
| AF026.004 | Cloud Audit Log Modification | A subject intentionally alters cloud audit records or exported cloud log data to conceal, misattribute, or misrepresent activity conducted within a cloud environment.
The subject may replace or modify log objects held in cloud storage, alter records within a log analytics workspace or data lake, manipulate a custom logging pipeline, or insert fabricated events into a downstream repository. Changes may affect the recorded identity, source address, operation, resource, timestamp, request parameters, or outcome.
Provider-maintained audit histories may prevent direct modification by tenant administrators. Investigators should therefore compare native provider records with exported copies, storage-object versions, logging-pipeline configurations, access records, and Security Information and Event Management (SIEM) data. |
| AF026.001 | Host Log Modification | A subject intentionally alters host-based log records to conceal, misattribute, or misrepresent activity conducted on an endpoint, server, or other operating system.
The subject may change timestamps, account names, event identifiers, source addresses, command details, or action outcomes within Windows Event Logs, Linux system or audit logs, macOS logs, security-agent logs, or other locally stored records. Modification may be performed using administrative tools, scripts, third-party log scrubbers, or direct access to
Investigators should compare local records with centrally forwarded logs, Endpoint Detection and Response (EDR) telemetry, process execution records, file metadata, and File Integrity Monitoring (FIM) events. This Sub-section applies where log content is altered but the record or log remains present. |
| AF026.003 | Network and Security Device Log Modification | A subject intentionally alters records generated by network or security infrastructure to conceal, misattribute, or misrepresent network activity.
Affected records may include firewall, proxy, Virtual Private Network (VPN), Domain Name System (DNS), Network Access Control (NAC), intrusion detection, router, switch, or secure web gateway logs. The subject may change source or destination addresses, ports, protocols, requested domains, authenticated identities, timestamps, security decisions, or action outcomes.
Modification may occur on the originating device, its management controller, a centralized collector, or another downstream repository. Investigators should compare device logs with NetFlow, packet inspection, endpoint telemetry, DNS records, identity events, and independently collected network records. |