CmdID

CmdID / Techniques / T1685

T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs

Adversaries may clear system logs to hide evidence of an intrusion. MITRE ATT&CK

3 Sigma rules T1685.006 on attack.mitre.org

Part of

MITRE ATT&CK

T1685Disable or Modify Tools

Sigma rules tagged with it

process creation, the highest levels first

highSyslog Clearing or Removal Via System UtilitiesMax Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux

mediumIndicator Removal on Host - Clear Mac System Logsremotephone, oscd.community · macOS

mediumLinux Logs Clearing AttemptsÖmer Günal, oscd.community · Linux