Clear Linux or Mac System Logs
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as: /var/log/messages:: General and system-related messages /var/log/secure or /var/log/auth.log: Authentication logs /var/log/utmp or /var/log/wtmp: Login records /var/log/kern.log: Kernel logs /var/log/cron.log: Crond logs /var/log/maillog: Mail server logs /var/log/httpd/: Web server access and error logs
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1438
Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).
- AN1439
Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.