Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:[1]
/var/log/messages:: General and system-related messages/var/log/secure or /var/log/auth.log: Authentication logs/var/log/utmp or /var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logs| ID | Name | Description |
|---|---|---|
| S1206 | JumbledPath |
JumbledPath can clear logs on all devices used along its connection path to compromised network infrastructure.[2] |
| S1016 | MacMa |
MacMa can clear possible malware traces such as application logs.[3] |
| S0279 | Proton | |
| G0106 | Rocke | |
| G1045 | Salt Typhoon |
Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.[2] |
| G1041 | Sea Turtle |
Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.[6] |
| G0139 | TeamTNT | |
| S1164 | UPSTYLE |
UPSTYLE clears error logs after reading embedded commands for execution.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M1041 | Encrypt Sensitive Information |
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary. |
| M1029 | Remote Data Storage |
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. |
| M1022 | Restrict File and Directory Permissions |
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments for actions that could be taken to remove or overwrite system logs. |
| DS0022 | File | File Deletion |
Monitor for unexpected deletion of a system log file, typically stored in /var/logs or /Library/Logs. |
| File Modification |
Monitor for changes made to system log files, typically stored in /var/log or /Library/Logs, for unexpected modifications to access permissions and attributes |