Tomcat WebServer Logs Deleted — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2023-02-16 / not supplied.

{
  "category": "file_delete",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 83ee4b09818a9f38491f81352f4e00a8826192852447ccdf93a78c1246e68bf4

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Tomcat WebServer Logs Deleted
id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
status: test
description: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
references:
    - Internal Research
    - https://linuxhint.com/view-tomcat-logs-windows/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-16
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: file_delete
    product: windows
detection:
    selection:
        TargetFilename|contains|all:
            - '\Tomcat'
            - '\logs\'
        TargetFilename|contains:
            - 'catalina.'
            - '_access_log.'
            - 'localhost.'
    condition: selection
falsepositives:
    - During uninstallation of the tomcat server
    - During log rotation
level: medium

Original YAML and metadata in JSON

False positives

• During uninstallation of the tomcat server
• During log rotation

Source references

• Internal Research (source note; no public URL supplied)
• https://linuxhint.com/view-tomcat-logs-windows/