back

Find sigma rule

Attack: Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

• /var/log/messages:: General and system-related messages
• /var/log/secure or /var/log/auth.log: Authentication logs
• /var/log/utmp or /var/log/wtmp: Login records
• /var/log/kern.log: Kernel logs
• /var/log/cron.log: Crond logs
• /var/log/maillog: Mail server logs
• /var/log/httpd/: Web server access and error logs

MITRE

Tactic

• defense-evasion

technique

• T1070.002

Test : Delete system log files using Applescript

OS

• macos

Description:

This test deletes the system log file using applescript using osascript via Finder application Note: The user may be prompted to grant access to the Finder application before the command can be executed successfully as part of TCC(Transparency, Consent, and Control) Framework. Refer: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive

Executor

sh

Sigma Rule

back