H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Audit Log Manipulation

The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.

Technique
TypeTechnique
External ID—
First seen2026-10-17
Last seen2026-10-17

Confidence

—

The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.

Labels

attack-patterncapec
7 recorded

Relationships

child-of
to Infrastructure Manipulation
Technique
child-of
from Log Injection-Tampering-Forging
Technique
child-of
from Web Server Logs Tampering
Technique
mapped-to
to Disable or Modify Cloud Logs
Technique
mapped-to
to Disable Windows Event Logging
Technique
mapped-to
to Impair Command History Logging
Technique
mapped-to
to Indicator Removal
Technique
1 external

References

capec
CAPEC-268
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance