AN0520
Analytic 0520
Windows
Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
WinEventLog:Sysmon
EventCode=23
WinEventLog:Security
EventCode=1102
WinEventLog:Sysmon
EventCode=13, 14
[TimeWindow]
Correlate indicator removal within X mins after persistence/setup activities
[TargetFilePathPattern]
Customize detection to log file paths or common registry hives
AN0521
Analytic 0521
Linux
Detects deletion or overwriting of bash history, syslog, audit logs, and .ssh metadata following privilege elevation or suspicious process spawning.
auditd:SYSCALL
unlink, rename, open
linux:cli
cleared or truncated .bash_history
[MonitoredPaths]
Adjust based on syslog/auditd file paths (/var/log/messages, /var/log/audit/audit.log)
[UserContext]
Scope to root/sudo usage or anomalous user behavior
AN0522
Analytic 0522
macOS
Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.
macos:unifiedlog
log stream cleared or truncated
fs:fsusage
unlink, fs_delete
macos:osquery
File modifications in ~/Library/Preferences/
[PlistTargetPaths]
Define which plist paths relate to LaunchAgents or LaunchDaemons
[ExecutionChainDepth]
Allow tuning for multi-process persistence chains
AN0523
Analytic 0523
Containers
Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.
docker:daemon
container file operations
ebpf:syscalls
Unexpected container volume unmount + file deletion
[LogMountPaths]
Tune based on how logs are exported (bind-mount, overlay)
[ContainerLabelScope]
Limit detection to suspicious containers or runtime classes
AN0524
Analytic 0524
ESXi
Tracks suspicious use of ESXi shell commands or PowerCLI to delete logs, rotate system files, or tamper with hostd/vpxa history.
esxi:hostd
rm, clearlogs, logrotate
[LogSourceType]
Tune per vCenter, vSphere, ESXi CLI telemetry collection
[LogPathPattern]
Target specific high-value log paths (e.g., /var/log/hostd.log)
AN0525
Analytic 0525
Office Suite
Detects deletion or hiding of security-related mail rules, audit mailboxes, or calendar/log sync artifacts indicative of tampering post-intrusion.
m365:exchange
Remove-InboxRule, Clear-Mailbox
m365:unified
PurgeAuditLogs, Remove-MailboxAuditLog
[TargetMailboxScope]
Limit by VIP mailboxes or external-facing users
[AuditLogDepth]
Tune for log deletion following lateral movement