#T1070.002 Clear Linux or Mac System Logs

Technique

  • Tactics: Defense Evasion
  • Description:

    Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

    • /var/log/messages:: General and system-related messages
    • /var/log/secure or /var/log/auth.log: Authentication logs
    • /var/log/utmp or /var/log/wtmp: Login records
    • /var/log/kern.log: Kernel logs
    • /var/log/cron.log: Crond logs
    • /var/log/maillog: Mail server logs
    • /var/log/httpd/: Web server access and error logs
  • First Seen: Lazarus targets defense industry with ThreatNeedle • 2021-02-25
MITRE ATT&CK

Tagged Reports

2021-02-25
Kaspersky
#ThreatNeedle #Defense #Lazarus #T1090.001 #T1016 #T1104 #T1036.003 #T1560.001 #T1543.003 #T1132.002 #T1057 #T1082 #T1059.003 #T1070.002 #T1557.001 #T1572 #T1547.001 #T1135 #T1049 #T1140 #T1036.004 #T1070.004 #T1041 #T1070.003 #T1021.002 #T1204.002 #T1071.001 #T1112 #T1083 #T1007 #T1033 #T1566.002 #T1569.002
« Back