Cross-source coverage
T1685.006 / ATT&CK
Disable or Modify Tools: Clear Linux or Mac System Logs
4 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:
/var/log/messages:: General and system-related messages/var/log/secure or /var/log/auth.log: Authentication logs/var/log/utmp or /var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logs
- Tactics
- Defense Impairment
- Platforms
- Linux · macOS
- Telemetry
-
auditd:SYSCALLmacos:unifiedlogfs:fsusage
How MITRE says to detect it DET0520
Behavioral Detection of Log File Clearing on Linux and macOS
Linux Analytic 1438
Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).
auditd:SYSCALLexecveauditd:SYSCALLPATH
macOS Analytic 1439
Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).
macos:unifiedlogprocessfs:fsusagetruncate, unlink, write
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Syslog Clearing or Removal Via System Utilities | High | Sigma |
| Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall | Medium | Sigma |
| Indicator Removal on Host - Clear Mac System Logs | Medium | Sigma |
| Linux Logs Clearing Attempts | Medium | Sigma |