← Back to Explore
T1070.002
Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the <code>/var/log/</code> directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * <code>/var/log/messages:</code>: General and system-related messages * <code>/var/log/secure</code> or <code>/var/log/auth.log</code>: Authenticatio...
LinuxmacOS
8
Detections
2
Sources
4
Threat Actors
BY SOURCE
4elastic4sigma
PROCEDURES (5)
Process Creation Monitoring3 detections
Auto-extracted: 3 detections for process creation monitoring
Kernel2 detections
Auto-extracted: 2 detections for kernel
Clear Log1 detections
Auto-extracted: 1 detections for clear log
Clear Log1 detections
Auto-extracted: 1 detections for clear log
General Monitoring1 detections
Auto-extracted: 1 detections for general monitoring
THREAT ACTORS (4)
DETECTIONS (8)
Attempt to Clear Kernel Ring Buffer
elastichigh
Attempt to Clear Logs via Journalctl
elasticmedium
Clear Linux Logs
sigmamedium
Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
sigmamedium
File Creation in /var/log via Suspicious Process
elasticmedium
Indicator Removal on Host - Clear Mac System Logs
sigmamedium
Syslog Clearing or Removal Via System Utilities
sigmahigh
System Log File Deletion
elasticmedium