Tomcat WebServer Logs Deleted

Title: Tomcat WebServer Logs Deleted
Status: test
Description:Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
References:
  -Internal Research
  -https://linuxhint.com/view-tomcat-logs-windows/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-16
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1070'

Logsource:

• category: file_delete
• product: windows

Detection:
  selection:
    TargetFilename|contains|all:
      -'\Tomcat'
      -'\logs\'

    TargetFilename|contains:
      -'catalina.'
      -'_access_log.'
      -'localhost.'

  condition:selection
Falsepositives:
  -During uninstallation of the tomcat server
  -During log rotation
Level: medium