# T1685.006 - Disable or Modify Tools: Clear Linux or Mac System Logs

## Description from ATT&CK

> Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)
> 
> * `/var/log/messages:`: General and system-related messages
> * `/var/log/secure or /var/log/auth.log`: Authentication logs
> * `/var/log/utmp or /var/log/wtmp`: Login records
> * `/var/log/kern.log`: Kernel logs
> * `/var/log/cron.log`: Crond logs
> * `/var/log/maillog`: Mail server logs
> * `/var/log/httpd/`: Web server access and error logs

[Source](https://attack.mitre.org/techniques/T1685/006)

## Atomic Tests

- [Atomic Test #1: rm -rf](#atomic-test-1-rm--rf)
- [Atomic Test #2: rm -rf](#atomic-test-2-rm--rf)
- [Atomic Test #3: Delete log files using built-in log utility](#atomic-test-3-delete-log-files-using-built-in-log-utility)
- [Atomic Test #4: Truncate system log files via truncate utility](#atomic-test-4-truncate-system-log-files-via-truncate-utility)
- [Atomic Test #5: Truncate system log files via truncate utility (freebsd)](#atomic-test-5-truncate-system-log-files-via-truncate-utility-freebsd)
- [Atomic Test #6: Delete log files via cat utility by appending /dev/null or /dev/zero](#atomic-test-6-delete-log-files-via-cat-utility-by-appending-devnull-or-devzero)
- [Atomic Test #7: Delete log files via cat utility by appending /dev/null or /dev/zero (freebsd)](#atomic-test-7-delete-log-files-via-cat-utility-by-appending-devnull-or-devzero-freebsd)
- [Atomic Test #8: System log file deletion via find utility](#atomic-test-8-system-log-file-deletion-via-find-utility)
- [Atomic Test #9: Overwrite macOS system log via echo utility](#atomic-test-9-overwrite-macos-system-log-via-echo-utility)
- [Atomic Test #10: Overwrite FreeBSD system log via echo utility](#atomic-test-10-overwrite-freebsd-system-log-via-echo-utility)
- [Atomic Test #11: Real-time system log clearance/deletion](#atomic-test-11-real-time-system-log-clearancedeletion)
- [Atomic Test #12: Delete system log files via unlink utility](#atomic-test-12-delete-system-log-files-via-unlink-utility)
- [Atomic Test #13: Delete system log files via unlink utility (freebsd)](#atomic-test-13-delete-system-log-files-via-unlink-utility-freebsd)
- [Atomic Test #14: Delete system log files using shred utility](#atomic-test-14-delete-system-log-files-using-shred-utility)
- [Atomic Test #15: Delete system log files using srm utility](#atomic-test-15-delete-system-log-files-using-srm-utility)
- [Atomic Test #16: Delete system log files using OSAScript](#atomic-test-16-delete-system-log-files-using-osascript)
- [Atomic Test #17: Delete system log files using Applescript](#atomic-test-17-delete-system-log-files-using-applescript)
- [Atomic Test #18: Delete system journal logs via rm and journalctl utilities](#atomic-test-18-delete-system-journal-logs-via-rm-and-journalctl-utilities)
- [Atomic Test #19: Overwrite Linux Mail Spool](#atomic-test-19-overwrite-linux-mail-spool)
- [Atomic Test #20: Overwrite Linux Log](#atomic-test-20-overwrite-linux-log)

### Atomic Test #1: rm -rf

Delete system and audit logs

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `989cc1b1-3642-4260-a809-54f9dd559683`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| syslog_path | path of syslog file to delete. On macos it's /var/log/system.log*, on linux, it's /var/log/syslog*. Also note for File events, that on macos, /var/ is a link to /private/var/. | string | /var/log/system.log|
| macos_audit_path | path of audit file to delete | string | /var/audit/[PII_REDACTED]3[PII_REDACTED]10700021|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
sudo rm -rf #{syslog_path}
if [ -d /var/audit ] ; then sudo rm -rf #{macos_audit_path} ; fi
```


#### Dependencies: Run with `sh`!

##### Description: target files must exist

###### Check Prereq Commands

```sh
if [ -d /var/audit ] ; then stat #{macos_audit_path} ; fi && stat #{syslog_path}
```

###### Get Prereq Commands

```sh
touch #{syslog_path}
if [ -d /var/audit ] ; then touch #{macos_audit_path} ; fi
```

### Atomic Test #2: rm -rf

Delete messages and security logs

**Supported Platforms:** Linux

**auto_generated_guid:** `bd8ccc45-d632-481e-b7cf-c467627d68f9`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
rm -rf /var/log/messages
rm -rf /var/log/security
```

### Atomic Test #3: Delete log files using built-in log utility

This test deletes main log datastore, inflight log data, time-to-live data(TTL), fault and error content

**Supported Platforms:** macOS

**auto_generated_guid:** `653d39cd-bae7-499a-898c-9fb96b8b5cd1`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
sudo log erase --all
sudo log erase --ttl #Deletes only time-to-live log content
```

### Atomic Test #4: Truncate system log files via truncate utility

This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content

**Supported Platforms:** macOS

**auto_generated_guid:** `6290f8a8-8ee9-4661-b9cf-390031bf6973`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| system_log_path | path of system log to delete. | string | /var/log/system.log|

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
sudo truncate -s 0 #{system_log_path} #size parameter shorthand
```


#### Dependencies: Run with `sh`!

##### Description: target files must exist

###### Check Prereq Commands

```sh
stat #{system_log_path}
```

###### Get Prereq Commands

```sh
touch #{system_log_path}
```

### Atomic Test #5: Truncate system log files via truncate utility (freebsd)

This test truncates the system log files using the truncate utility with (-s 0 or --size=0) parameter which sets file size to zero, thus emptying the file content

**Supported Platforms:** Linux

**auto_generated_guid:** `14033063-ee04-4eaf-8f5d-ba07ca7a097c`

#### Attack Commands: Run with `sh`! Elevation Required (e.g. root or admin)

```sh
truncate -s 0 /var/log/messages #size parameter shorthand
truncate --size=0 /var/log/security #size parameter
```

### Atomic Test #6: Delete log files via cat utility by appending /dev/null or /dev/zero

The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility

**Supported Platforms:** macOS

**auto_generated_guid:** `c23bdb88-928d-493e-b46d-df2906a50941`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|