Could an attacker delete or alter logs?¶

Yes. An attacker may delete, alter or suppress logs to reduce the evidence left behind.

But the possibility of tampering is not the same as proof that tampering occurred.

Avoid the dangerous assumption¶

The dangerous assumption is that every gap, missing event or inconsistent record proves an attacker interfered with the logs.

It may have a routine technical explanation.

An attacker with sufficient access may clear local logs, stop logging services, alter configuration, delete cloud records or interfere with collectors. They may also use legitimate administrative tools to make the activity look ordinary.

However, retention expiry, storage rollover, failed collection, maintenance, export filtering and system faults can produce similar gaps.

Investigators should first establish what access would have been required to alter the relevant records. Ask who held that access, whether the system recorded administrative changes and whether copies existed elsewhere.

Preserve source logs, collector records, SIEM events, configuration history, administrator activity and any evidence of service stoppage or log clearing. Compare local records with remote or provider-held copies. A discrepancy between independent sources may be significant.

Look for events showing audit-policy changes, log-service shutdown, file deletion, unusual privilege use or sudden loss of several event types at once. But interpret these carefully: routine maintenance can produce similar entries.

Do not describe records as tampered with unless the evidence supports that conclusion. Where the evidence shows only a gap with several possible causes, report those alternatives.

Operational takeaway¶

Attackers can delete, alter or suppress logs, but investigators should prove the access, mechanism and resulting inconsistency rather than treating every gap as evidence of deliberate tampering.