T1685.006 Clear Linux or Mac System Logs

sub-techniqueEnterprise

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as: * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs

01

platforms

Platforms this applies to.

LinuxmacOS
02

tactics

ATT&CK tactics this technique serves.

03

sub-technique of

The broader entity this sits under.

T1685Disable or Modify Tools
04

mitigations

ATT&CK mitigations that reduce this.

05

detected by (3)

Data components that detect this.

06

groups (4)

Threat groups associated with this.

07

software (4)

Malware and tools associated with this.

09

source

Where this definition is published.

MITRE ATT&CK