Indicator Removal

Traces can be changed or deleted

Indicator removal alters or deletes artifacts that could reveal activity. The relevant traces may include logs, files, histories, or other evidence left by system use. An actor may remove them to complicate investigation, but the absence of an expected artifact does not automatically establish deliberate cleanup.

Legitimate retention, maintenance, privacy controls, and application behavior also remove records. Investigators should identify the affected source, its normal lifecycle, the changing principal or process, and the relationship to other observed events.

A log gap follows suspicious activity

In a fictional environment, a server's local log history disappears shortly after an unexplained administrative session. The analyst checks log service events, configuration, retention settings, storage health, and the identity and process activity around the gap.

A scheduled maintenance task or full storage condition might explain missing records. The team compares that explanation with operational documentation and independent sources. A central collector may preserve events that are no longer present locally, subject to its own coverage and delivery status.

The investigation should separate a confirmed deletion action from an unexplained absence. If no record shows who changed the log, do not invent an attribution from timing alone. The gap may still materially limit confidence in the incident scope.

Look beyond the removed source

Endpoint, identity, network, application, and centralized records can provide complementary evidence. Preserve them promptly and record their time interpretation. An actor's removal of one trace does not guarantee that every related observation disappeared.

Logs and telemetry explains collection and retention assumptions. Hide Artifacts concerns reduced visibility without necessarily deleting content, while Rootkit addresses interference with system views. Use the distinction supported by the case.

A missing file or history entry can also have several explanations. Review normal application behavior before treating every absence as anti-forensics. Evidence of deliberate cleanup should connect an action with the affected artifact where possible.

Preserve the remaining trail

Contain harmful access as justified and protect available evidence before restoration or routine maintenance changes it further. Document response actions that themselves modify records so investigators can distinguish them from earlier activity.

Correct unauthorized log settings and review the access that allowed alteration. Restoring collection improves future visibility but does not recreate all missing historical events.

For practice, compare a normal retention rollover with a fictional log-clearing action following unauthorized access. Identify the configuration, actor, timing, and independent evidence needed to distinguish them. Incident reporting and handover should explain which conclusions are supported despite the gap and which remain unresolved, rather than turning missing evidence into either reassurance or certainty.

Related concepts

• MITRE ATT&CK
• Incident response