T1685.006 Clear Linux or Mac System Logs
Subtécnica de T1685 Disable or Modify Tools
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Syslog Clearing or Removal Via System Utilitieshightest · linux
- Linux Logs Clearing Attemptsmediumstable · linux
- Indicator Removal on Host - Clear Mac System Logsmediumtest · macos
- Clear or Disable Kernel Ring Buffer Logs via Syslog Syscallmediumexperimental · linux
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.