Sub-technique of T1685 Disable or Modify Tools.View on attack.mitre.org
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:
* `/var/log/messages:`: General and system-related messages
* `/var/log/secure or /var/log/auth.log`: Authentication logs
* `/var/log/utmp or /var/log/wtmp`: Login records
* `/var/log/kern.log`: Kernel logs
* `/var/log/cron.log`: Crond logs
* `/var/log/maillog`: Mail server logs
* `/var/log/httpd/`: Web server access and error logs
Rules on DetectionCode tagged with T1685.006.
| Rule | Level | Log source |
|---|---|---|
| Syslog Clearing or Removal Via System Utilities | high | linux / process_creation |
| Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall | medium | linux / NULL |
| Indicator Removal on Host - Clear Mac System Logs | medium | macos / process_creation |
| Linux Logs Clearing Attempts | medium | linux / process_creation |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupRocke | Rocke has cleared log files within the /var/log/ folder. |
| GroupSalt Typhoon | Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp. |
| GroupSea Turtle | Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions. |
| GroupTeamTNT | TeamTNT has removed system logs from |
| Used by | Procedure example |
|---|---|
| MalwareJumbledPath | JumbledPath can clear logs on all devices used along its connection path to compromised network infrastructure. |
| MalwareMacMa | MacMa can clear possible malware traces such as application logs. |
| MalwareProton | Proton removes logs from |
| MalwareUPSTYLE | UPSTYLE clears error logs after reading embedded commands for execution. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
