Skip to main content

CCC.Core.TH07: Logs are Tampered With or Deleted

Threat ID:CCC.Core.TH07
Title:Logs are Tampered With or Deleted
Description:

Tampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.

Related Capabilities

IDTitleDescription
CCC.Core.F03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.
CCC.Core.F10Log PublicationThe service automatically publishes structured, verbose records of activities, operations, or events that occur within the service.

External Mappings

Reference IDEntry IDStrengthRemarks
MITRE-ATT&CK
T1070
0
Indicator Removal on Host
MITRE-ATT&CK
T1565
0
Data Manipulation (for altering log entries)
MITRE-ATT&CK
T1027
0
Obfuscated Files or Information

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.ObjStor.C06Access Logs are Stored in a Separate Data StoreEnsure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red). Data
2
6
1
CCC.Core.C09Ensure Integrity of Access LogsEnsure that access logs are always recorded to an external location. Data
3
5
3