| name | T1070.002_clear-linux-or-mac-system-logs |
| description | Adversaries may clear system logs to hide evidence of an intrusion. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1070.002","defense-evasion","linux","macos","sub-technique"] |
| technique_id | T1070.002 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Linux","macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1070/002 |
| tech_stack | ["linux","macos"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1070","T1070.001","T1070.003","T1070.004","T1070.005","T1070.006","T1070.007","T1070.008","T1070.009","T1070.010"] |
| prerequisites | ["T1070"] |
| severity_boost | {"T1070":"Chain with T1070 for deeper attack path","T1070.001":"Chain with T1070.001 for deeper attack path","T1070.003":"Chain with T1070.003 for deeper attack path"} |
T1070.002 Clear Linux or Mac System Logs
Sub-technique of: T1070
High-Level Description
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:
/var/log/messages:: General and system-related messages/var/log/secure or /var/log/auth.log: Authentication logs/var/log/utmp or /var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logs
Kill Chain Phase
Platforms: Linux, macOS
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: rm -rf
Delete system and audit logs
Supported Platforms: macos, linux
Elevation Required: Yes
sudo rm -rf
if [ -d /var/audit ] ; then -rf
