CAPEC-571 — Block Logging to Central Repository
CAPEC-571: Block Logging to Central Repository
MITRE CAPEC attack pattern
| Status | Draft |
| Typical severity | Low |
| Likelihood of attack | — |
| Catalogue | CAPEC 3.9 (2023-01-24) |
Description
An adversary prevents host-generated logs being delivered to a central location in an attempt to hide indicators of compromise.
Where this sits in the chain
A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.
ATT&CK techniques: T1562.002, T1562.006, T1562.008
Mappings that no longer resolve
CAPEC 3.9 (2023-01-24) maps this pattern to T1562.002, T1562.006, T1562.008, which the current ATT&CK corpus does not carry — MITRE has revoked or relocated them since CAPEC was last published. The mapping is recorded here rather than dropped, because a stale cross-reference is a fact about the taxonomies, not a gap in this page.