用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1070-002-clear-linux-or-mac-system-logs命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1070.002_clear-linux-or-mac-system-logs |
| description | Adversaries may clear system logs to hide evidence of an intrusion. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1070.002","defense-evasion","linux","macos","sub-technique"] |
| technique_id | T1070.002 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Linux","macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1070/002 |
| tech_stack | ["linux","macos"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1070","T1070.001","T1070.003","T1070.004","T1070.005","T1070.006","T1070.007","T1070.008","T1070.009","T1070.010"] |
| prerequisites | ["T1070"] |
| severity_boost | {"T1070":"Chain with T1070 for deeper attack path","T1070.001":"Chain with T1070.001 for deeper attack path","T1070.003":"Chain with T1070.003 for deeper attack path"} |
Sub-technique of: T1070
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:
/var/log/messages:: General and system-related messages/var/log/secure or /var/log/auth.log: Authentication logs/var/log/utmp or /var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logsPlatforms: Linux, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Delete system and audit logs
Supported Platforms: macos, linux Elevation Required: Yes
sudo rm -rf #{syslog_path}
if [ -d /var/audit ] ; then -rf
Dependencies:
Delete messages and security logs
Supported Platforms: linux Elevation Required: Yes
rm -rf /var/log/messages
rm -rf /var/log/security
This test deletes main log datastore, inflight log data, time-to-live data(TTL), fault and error content
Supported Platforms: macos Elevation Required: Yes
sudo log erase --all
sudo log erase --ttl #Deletes only time-to-live log content
This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content
Supported Platforms: macos Elevation Required: Yes
sudo truncate -s 0 #{system_log_path} #size parameter shorthand
Dependencies:
This test truncates the system log files using the truncate utility with (-s 0 or --size=0) parameter which sets file size to zero, thus emptying the file content
Supported Platforms: linux Elevation Required: Yes
truncate -s 0 /var/log/messages #size parameter shorthand
truncate --size=0 /var/log/security #size parameter
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Clear Linux or Mac System Logs by examining the target platforms (Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1070.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
| Finding | Severity | Impact |
|---|---|---|
| Clear Linux or Mac System Logs technique applicable | Low | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |