What action involves removing system log entries that record an attacker\'s activities?

What action involves removing system log entries that record an attacker\'s activities?

• A. Deleting Files
• B. Wevtutil
• C. Clearing Logs
• D. Disabling Windows Functionality

Answer: (C)

Removing existing log entries is clearing logs. Logs record what happened on a system, including attacker activity, so erasing those entries directly wipes away evidence of the intrusion. Clearing logs is a quintessential cover-tracks tactic used to hinder detection and incident response. Deleting files is too broad and not specific to the log system itself, while a tool like Wevtutil is just a method that can perform the action of clearing logs. Disabling Windows functionality would stop or disrupt logging going forward rather than removing the logs that already exist.

Removing existing log entries is clearing logs. Logs record what happened on a system, including attacker activity, so erasing those entries directly wipes away evidence of the intrusion. Clearing logs is a quintessential cover-tracks tactic used to hinder detection and incident response.

Deleting files is too broad and not specific to the log system itself, while a tool like Wevtutil is just a method that can perform the action of clearing logs. Disabling Windows functionality would stop or disrupt logging going forward rather than removing the logs that already exist.