Real-time monitoring identifies an audit log clearing event or deletion/truncation of an Industrial Control System (ICS) vendor application log file, immediately preceded by other suspicious activity on the same host within a short lookback window. Documented in the CaddyWiper deployment alongside Industroyer2, explicitly intended to destroy evidence and slow forensic recovery. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | WinEventLog:Security | Windows Security Event ID 4688: EventCode=1102 correlated with any other Medium+ confidence alert on the same host within log clear lookback window |
| File Deletion (DC0040) | WinEventLog:Sysmon | EventCode=23 or wevtutil/Clear-EventLog invocation deleting Industrial Control Systems (ICS) vendor application log file by process not in authorized log management tools |
| WinEventLog:System | EventCode=104 outside scheduled log rotation window |
| Field | Description |
|---|---|
| AuthorizedLogManagementTools | Allowlist of processes/accounts authorized to delete or truncate ICS application logs. |
| LogClearLookbackWindow | Time window prior to a log-clear event within which other suspicious activity is considered correlated. |
| ScheduledLogRotationWindow | Documented schedule for legitimate, automated log rotation/archival. |
Real-time monitoring identifies truncation or deletion of Industrial Control System (ICS) application or auth log files, or modification of bash history, by a User Identifier (UID) that does not normally manage log rotation. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: modification of bash_history file by uid not normally performing interactive shell sessions |
| File Deletion (DC0040) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: truncate/shred/rm on Industrial Control Systems (ICS) application log files or auth.log by User Identifier (UID) not in authorized log admin UIDs |
| Field | Description |
|---|---|
| AuthorizedLogManagementTools | Allowlist of processes/accounts authorized to delete or truncate ICS application logs. |
| LogClearLookbackWindow | Time window prior to a log-clear event within which other suspicious activity is considered correlated. |
| ScheduledLogRotationWindow | Documented schedule for legitimate, automated log rotation/archival. |
Real-time monitoring identifies Industrial Control System (ICS) network device syslog showing a gap in expected event sequence numbers, or syslog forwarding interruption from a device coinciding with a period of suspicious activity on that device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | syslog sequence number gap or forwarding interruption coinciding with suspicious activity window for the same device |
| Field | Description |
|---|---|
| AuthorizedLogManagementTools | Allowlist of processes/accounts authorized to delete or truncate ICS application logs. |
| LogClearLookbackWindow | Time window prior to a log-clear event within which other suspicious activity is considered correlated. |
| ScheduledLogRotationWindow | Documented schedule for legitimate, automated log rotation/archival. |
Real-time monitoring identifies Industrial Control System (ICS) field device event logs being cleared via ICS protocol commands from a source not in the approved engineering workstation list, occurring immediately following other suspicious ICS activity on the same device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | event buffer clear or log clear service from source not in engineering workstation list, correlated with preceding suspicious activity on the same device |
| Field | Description |
|---|---|
| AuthorizedLogManagementTools | Allowlist of processes/accounts authorized to delete or truncate ICS application logs. |
| LogClearLookbackWindow | Time window prior to a log-clear event within which other suspicious activity is considered correlated. |
| ScheduledLogRotationWindow | Documented schedule for legitimate, automated log rotation/archival. |