Cross-source coverage
T1070.002 / ATT&CK
Indicator Removal: Clear Linux or Mac System Logs
ATT&CK has retired this technique. Rules still tag it; the current id is T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs.
From MITRE ATT&CK 19.2
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:
/var/log/messages:: General and system-related messages/var/log/secureor/var/log/auth.log: Authentication logs/var/log/utmpor/var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logs
- Tactics
- Stealth
- Platforms
- Linux · macOS
- Telemetry
- —
socfortress/Wazuh-Rules
7 rules| Detection | Severity | Format |
|---|---|---|
| Log shredding detected (T1070.002) | High | Wazuh XML |
| Suspicious log deletion or truncation attempt (T1070.002) | High | Wazuh XML |
| Unlink attempt on system log (T1070.002) | High | Wazuh XML |
| Use of rm to delete system logs (T1070.002) | High | Wazuh XML |
| Attempt to overwrite or clear logs using cat/dd and /dev/null or /dev/zero (T1070.002) | Medium | Wazuh XML |
| Echo used to overwrite log files (T1070.002) | Medium | Wazuh XML |
| Log truncation detected using truncate (T1070.002) | Medium | Wazuh XML |
elastic/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Clear Kernel Ring Buffer | High | Elastic TOML |
| Attempt to Clear Logs via Journalctl | Medium | Elastic TOML |
| File Creation in /var/log via Suspicious Process | Medium | Elastic TOML |
| System Log File Deletion | Medium | Elastic TOML |
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Clear Kernel Ring Buffer via Dmesg | Undefined | Elastic TOML |
| Attempt to Clear Logs via Journalctl | Undefined | Elastic TOML |
| Loadable Kernel Module Load Followed by Log Clearing | Undefined | Elastic TOML |
| Multiple System Log Files Deletion | Undefined | Elastic TOML |