Find sigma rule
Attack: Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/
directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)
-
/var/log/messages:
: General and system-related messages -
/var/log/secure
or/var/log/auth.log
: Authentication logs -
/var/log/utmp
or/var/log/wtmp
: Login records -
/var/log/kern.log
: Kernel logs -
/var/log/cron.log
: Crond logs -
/var/log/maillog
: Mail server logs -
/var/log/httpd/
: Web server access and error logs
MITRE
Tactic
- defense-evasion
technique
- T1070.002
Test : Delete system log files using shred utility
OS
- macos
Description:
This test overwrites the contents of the log file with zero bytes(-z) using three passes(-n 3) of data, and then delete the file(-u) securely
Executor
sh