T1685.006 Clear Linux or Mac System Logs
Sub-technique of T1685 Disable or Modify Tools
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Syslog Clearing or Removal Via System Utilitieshightest · linux
- Linux Logs Clearing Attemptsmediumstable · linux
- Indicator Removal on Host - Clear Mac System Logsmediumtest · macos
- Clear or Disable Kernel Ring Buffer Logs via Syslog Syscallmediumexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.