The archive

Beyond 1102: detecting selective EVTX deletion in Chainsaw

Event ID 1102 catches the loud version of attacker log tampering. Selective deletion of individual records inside an EVTX, the technique DanderSpritz's eventlogedit module made famous, doesn't fire it. Walking through the gap, who exploits it, and the analyse gaps subcommand landing in Chainsaw.