← Back to Explore
T1685.006
Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Log...
LinuxmacOS
4
Detections
1
Sources
4
Threat Actors
BY SOURCE
4sigma
PROCEDURES (2)
Process Creation Monitoring3 detections
Auto-extracted: 3 detections for process creation monitoring
Kernel Monitoring1 detections
Auto-extracted: 1 detections for kernel monitoring