CAPEC Definitions

    CAPEC Definitions / CAPEC-571

    CAPEC-571: Block Logging to Central Repository

    An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.

    Severity:Low
    Possibility:

    Extended Description

    In the case of network based reporting of indicators, an adversary may block traffic associated with reporting to prevent central station analysis. This may be accomplished by many means such as stopping a local process to creating a host-based firewall rule to block traffic to a specific server. In the case of local based reporting of indicators, an adversary may block delivery of locally-generated log files themselves to the central repository.

    Mitigations

    No Mitigations found.

    Relationships with other CAPECs

    CAPEC-161: Infrastructure Manipulation

    Prerequisites

    No prerequisites found.

    Related Weaknesses

    No related Weaknesses found.