T1685.006Defense Impairment
Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as: * `/var/log/messages:`: General and system-related messages * `/var/log/secure or…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1685.006Clear Linux or Mac System LogsT1685.0064 general rules
- Syslog Clearing or Removal Via System Utilitieshightest
- Linux Logs Clearing Attemptsmediumstable
- Indicator Removal on Host - Clear Mac System Logsmediumtest
- Clear or Disable Kernel Ring Buffer Logs via Syslog Syscallmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Clear Linux or Mac System Logs
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.