Anti-forensics
Also known as: Anti-Forensik, trace obliteration
Techniques attackers use to delete, falsify or mislead – log tampering, timestamp forgery, encryption and memory-resident malware among them.
Anti-forensics targets the gap between incident and acquisition. The longer an attacker goes undetected, the more thoroughly they can tidy up. The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report stresses that manipulated input data directly corrupts Artificial Intelligence (AI)-assisted analysis as well. The most effective countermeasure is logging the attacker cannot reach: centrally collected, forwarded promptly, retained outside their range. That is what a Security Information and Event Management (SIEM) provides – if it was in place before the incident.