Find sigma rule
Attack: Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/
directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)
-
/var/log/messages:
: General and system-related messages -
/var/log/secure
or/var/log/auth.log
: Authentication logs -
/var/log/utmp
or/var/log/wtmp
: Login records -
/var/log/kern.log
: Kernel logs -
/var/log/cron.log
: Crond logs -
/var/log/maillog
: Mail server logs -
/var/log/httpd/
: Web server access and error logs
MITRE
Tactic
- defense-evasion
technique
- T1070.002
Test : System log file deletion via find utility
OS
- macos
Description:
This test finds and deletes the system log files within /var/log/ directory using various executions(rm, shred, unlink)
Executor
sh