FORENSIA

ATT&CK · T1685.006 · sub-technique

Clear Linux or Mac System Logs

Tactics: defense-impairment

About

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as: * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs

Platforms: Linux, macOSParent: T1685 Disable or Modify ToolsMITRE ATT&CK ↗

Used by actors

4 known groups

Software

4 malware/tools implement this

ProtonMacMaUPSTYLEJumbledPath

Corpus indicators tagged with this technique

0 indicators in the corpus carry T1685.006.

No corpus indicators are tagged with this technique yet.