{
  "source_id": "mandiant-russian-targeting-log-gaps-2021",
  "source_key": "mandiant-russian-targeting-log-gaps-2021",
  "title": "Suspected Russian Activity Targeting Government and Business Entities Around the Globe",
  "publisher": "Mandiant / Google Cloud",
  "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/russian-targeting-gov-business",
  "originally_published": null,
  "most_recently_updated": null,
  "first_collected": "2026-10-22T19:50:55+00:00",
  "last_successfully_checked": "2026-10-22T19:50:55+00:00",
  "original_content_digest": "3d90635f20a29b38c68b9be718b9de4f99f77a6647d0f7ce731ecf76e6bbec01",
  "source_publication_date": "2021-12-06",
  "date_precision": "day",
  "affected_platform": "Windows / Microsoft 365 / enterprise identity infrastructure",
  "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "The original report describes observed stopping of Sysmon and Splunk logging and clearing of Windows events. Those actions directly affect local and forwarded investigative visibility."
  ],
  "editorial_annotation": "Mandiant reports stopped Sysmon and Splunk logging alongside cleared Windows events. The combination illustrates why source generation, forwarding health, retained central copies, and cloud identity records must be reviewed as separate evidence paths.",
  "topic": "Log visibility",
  "evidence_quote_reference": {
    "short_quote": "cleared Windows Event Logs",
    "section": "Reviewed original report; locate the quoted phrase in context."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [
    "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
    "https://anti-forensics.com/reference/artifacts/security-log-clear-records/",
    "https://anti-forensics.com/reference/artifacts/cloud-audit-scope-and-identity/"
  ],
  "record_version_digest": "81e840df9d6695190495bede0139061a9bfd0fdc90fef7495960a09390249741"
}