The hacker who deleted their login events but not their logout events and may have cleared all event logs is believed to be inexperienced in using Shadow Brokers' hacks. Their intent may be to contest the NSA's most sophisticated hacking group and burn some of their costly exploits.
The Shadow Brokers, a group that published hacking tools stolen from the NSA, has gone quiet for over two years. While it appears that Russia might be behind the group, no one knows for certain, and the hunt for the group's true identity and intentions continues.
The NSA is believed to have created a set of exploits that can bypass security on Microsoft Windows, but has kept them private and not reported them to the company. The group known as Shadow Brokers appears to have obtained these exploits and is now offering them for sale, demonstrating high-level capabilities.
The NSA may be keeping zero-day exploits to themselves to improve espionage and surveillance, which can be seen as defensive-minded, but a truly defensive-minded approach would involve working with software vendors to fix vulnerabilities. The Shadow Brokers' message may place the NSA under more scrutiny for hoarding these exploits.
The article discusses how to identify if a hacker is using Shadow Brokers hacks by understanding how windows logging works and identifying any abnormal deletion of logs.