Find sigma rule
Attack: Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/
directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)
-
/var/log/messages:
: General and system-related messages -
/var/log/secure
or/var/log/auth.log
: Authentication logs -
/var/log/utmp
or/var/log/wtmp
: Login records -
/var/log/kern.log
: Kernel logs -
/var/log/cron.log
: Crond logs -
/var/log/maillog
: Mail server logs -
/var/log/httpd/
: Web server access and error logs
MITRE
Tactic
- defense-evasion
technique
- T1070.002
Test : Truncate system log files via truncate utility (freebsd)
OS
- linux
Description:
This test truncates the system log files using the truncate utility with (-s 0 or –size=0) parameter which sets file size to zero, thus emptying the file content
Executor
sh