Windows Tomcat Log File Deletion Indicating Possible Forensic Evidence Destruction
Flags Windows file deletions matching Tomcat log paths and common Catalina/localhost access log filename patterns.
- Product
- windows
- Category
- file_delete
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-16
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file deletion events on Windows where the target filename path and name match Tomcat log locations (e.g., \Tomcat\logs\) and common Tomcat log filenames such as catalina., _access_log., and localhost. Deleting these logs can remove traces of web activity and hinder incident investigation. It relies on file deletion telemetry containing the deleted target filename (TargetFilename).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Tomcat Log File Deletion Indicating Possible Forensic Evidence Destruction
id: 3f4f1d98-412e-4001-bd7f-4c4f3155f66f
status: test
description: This rule flags file deletion events on Windows where the target filename path and name match Tomcat log locations (e.g., \Tomcat\logs\) and common Tomcat log filenames such as catalina., _access_log., and localhost. Deleting these logs can remove traces of web activity and hinder incident investigation. It relies on file deletion telemetry containing the deleted target filename (TargetFilename).
references:
- Internal Research
- https://linuxhint.com/view-tomcat-logs-windows/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-16
tags:
- attack.stealth
- attack.t1070
logsource:
category: file_delete
product: windows
detection:
selection:
TargetFilename|contains|all:
- \Tomcat
- \logs\
TargetFilename|contains:
- catalina.
- _access_log.
- localhost.
condition: selection
falsepositives:
- During uninstallation of the tomcat server
- During log rotation
level: medium
license: DRL-1.1
related:
- id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8
type: derived