Windows: Deletion of Tomcat Web Server Log Files

Flags Windows file deletions matching Tomcat log paths and common Catalina/localhost access log filename patterns.

FreeUnreviewedSigmamediumv1

windows-deletion-of-tomcat-web-server-log-files-270185ff

title: "Windows: Deletion of Tomcat Web Server Log Files"
id: 3f4f1d98-412e-4001-bd7f-4c4f3155f66f
status: test
description: This rule identifies file deletions on Windows where the deleted path and filename indicate Tomcat server logs, including log directory entries and common Catalina access log patterns. Attackers may remove these logs to hinder forensic investigation and reduce available evidence of web activity. The detection relies on file deletion telemetry with the deleted TargetFilename matching specific Tomcat-related path and filename substrings.
references:
  - Internal Research
  - https://linuxhint.com/view-tomcat-logs-windows/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-16
tags:
  - attack.stealth
  - attack.t1070
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \Tomcat
      - \logs\
    TargetFilename|contains:
      - catalina.
      - _access_log.
      - localhost.
  condition: selection
falsepositives:
  - During uninstallation of the tomcat server
  - During log rotation
level: medium
license: DRL-1.1
related:
  - id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
    type: derived

What it detects

This rule identifies file deletions on Windows where the deleted path and filename indicate Tomcat server logs, including log directory entries and common Catalina access log patterns. Attackers may remove these logs to hinder forensic investigation and reduce available evidence of web activity. The detection relies on file deletion telemetry with the deleted TargetFilename matching specific Tomcat-related path and filename substrings.

Known false positives

During uninstallation of the tomcat server
During log rotation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.