T1070 / ATT&CK

Windows Analytic 0520

Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.

• WinEventLog:Sysmon EventCode=23
• WinEventLog:Security EventCode=1102
• WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0521

Detects deletion or overwriting of bash history, syslog, audit logs, and.ssh metadata following privilege elevation or suspicious process spawning.

• auditd:SYSCALL unlink, rename, open
• linux:cli cleared or truncated .bash_history

macOS Analytic 0522

Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.

• macos:unifiedlog log stream cleared or truncated
• fs:fsusage unlink, fs_delete
• macos:osquery File modifications in ~/Library/Preferences/

Containers Analytic 0523

Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.

• docker:daemon container file operations
• ebpf:syscalls Unexpected container volume unmount + file deletion

ESXi Analytic 0524

Tracks suspicious use of ESXi shell commands or PowerCLI to delete logs, rotate system files, or tamper with hostd/vpxa history.

• esxi:hostd rm, clearlogs, logrotate

Office Suite Analytic 0525

Detects deletion or hiding of security-related mail rules, audit mailboxes, or calendar/log sync artifacts indicative of tampering post-intrusion.

• m365:exchange Remove-InboxRule, Clear-Mailbox
• m365:unified PurgeAuditLogs, Remove-MailboxAuditLog