An attacker wants to make changes to a log file to clear his tracks. Instead of erasing the logs, he just makes changes to some of the entries. What is he trying to do?
A) Throw off the timeline to confuse the investigator
B) Create the appearance of decoy traffic
C) Make an extremely unusual event so it wouldn't be looked at
D) Taunt the administrators

Question

Quizplus · Accepted Answer

Be careful on the wording here: If false entries looked like decoy traffic it would only show someone is in there messing around. Unusual events are often false positives but should be confirmed. The timeline is the most valuable thing an investigator can determine when tracking down events. Part of the clearing tracks phase of an attack is to take investigators off the scent, ideally without them realizing they are even playing the game at all.

An Attacker Wants to Make Changes to a Log File