{"id":"T1685.006","name":"Clear Linux or Mac System Logs","url":"https://attack.mitre.org/techniques/T1685/006","tactics":["defense-impairment"],"platforms":["Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0520","stix_id":"x-mitre-detection-strategy--20d79eae-0c09-410a-b99a-f8cb6ec9153c","name":"Behavioral Detection of Log File Clearing on Linux and macOS","url":"https://attack.mitre.org/detectionstrategies/DET0520","analytics":[{"id":"AN1438","stix_id":"x-mitre-analytic--6ffa0db8-a088-4e7a-b8e5-50a204762cca","name":"Analytic 1438","description":"Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).","url":"https://attack.mitre.org/detectionstrategies/DET0520#AN1438","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"PATH","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"TimeWindow","description":"The time window used to correlate log file interaction and suspicious command execution."},{"field":"LogFilePathPattern","description":"Regex pattern used to match monitored log file paths (e.g., /var/log/auth.log)."},{"field":"UserContext","description":"User or group (e.g., root) that should trigger higher severity detection."}],"live":true,"detection_strategies":["DET0520"],"techniques":["T1685.006"]},{"id":"AN1439","stix_id":"x-mitre-analytic--b4e2440e-8956-4ae6-94cb-da859f407f27","name":"Analytic 1439","description":"Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).","url":"https://attack.mitre.org/detectionstrategies/DET0520#AN1439","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"truncate, unlink, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"TimeWindow","description":"Duration in which process activity and file I/O should be temporally linked."},{"field":"LogFilePathPattern","description":"Tunable path filter for macOS logs such as /var/log/system.log or /var/log/asl.log."},{"field":"UserContext","description":"Detects higher risk when log deletion is performed by unusual users (e.g., interactive vs. system users)."}],"live":true,"detection_strategies":["DET0520"],"techniques":["T1685.006"]}],"live":true,"version":"1.0","techniques":["T1685.006"]}],"sigma_rules":[{"id":"3fcc9b35-39e4-44c0-a2ad-9e82b6902b31","title":"Syslog Clearing or Removal Via System Utilities","author":"Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2025-10-15","description":"Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md","https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.006"],"path":"rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml","techniques":["T1685.006"],"cves":[]},{"id":"80915f59-9b56-4616-9de0-fd0dea6c12fe","title":"Linux Logs Clearing Attempts","author":"Ömer Günal, oscd.community","status":"stable","level":"medium","date":"2020-10-07","modified":"2026-03-18","description":"Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.\nAdversaries often try to clear logs to cover their tracks after performing malicious activities.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.006"],"path":"rules/linux/process_creation/proc_creation_lnx_clear_logs.yml","techniques":["T1685.006"],"cves":[]},{"id":"acf61bd8-d814-4272-81f0-a7a269aa69aa","title":"Indicator Removal on Host - Clear Mac System Logs","author":"remotephone, oscd.community","status":"test","level":"medium","date":"2020-10-11","modified":"2022-09-16","description":"Detects deletion of local audit logs","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.006"],"path":"rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml","techniques":["T1685.006"],"cves":[]},{"id":"eca5e022-d368-4043-98e5-9736fb01f72f","title":"Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-27","modified":"2025-12-05","description":"Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),\n(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel\nring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation\nor privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.\n","references":["https://man7.org/linux/man-pages/man2/syslog.2.html","https://man7.org/linux/man-pages/man1/dmesg.1.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.defense-impairment","attack.t1685.006"],"path":"rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml","techniques":["T1685.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}