T1685.006 — Clear Linux or Mac System Logs

Tactic: Defense Impairment · Platforms: Linux, macOS

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (2)

T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs

title: "T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs"
id: 9b3cecd8-d071-41f9-9108-7d463964beeb
description: 'Behavioral Detection of Log File Clearing on Linux and macOS. Covers deletion (unlink/unlinkat) as before, plus truncation-based clearing that the original rule missed entirely: explicit truncate/ftruncate syscalls, the truncate command line utility, and shell one-liners (bash -c "... > /var/log/...", cat /dev/null > ...) that truncate the log file via redirection -- visible in auditd EXECVE argv only when passed as a literal -c string to the shell. Dropped the ineffective rmdir syscall since these targets are files, not directories. Tune using: TimeWindow, LogFilePathPattern, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1685/006
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.006

logsource:
  category: file_delete
  product: linux

detection:
  selection_syscall_delete:
    type: SYSCALL
    syscall:
      - unlink
      - unlinkat
      - truncate
      - ftruncate
  selection_log_path:
    name|contains:
      - '/var/log/audit/'
      - '/var/log/auth.log'
      - '/var/log/secure'
  filter_logrotate:
    exe|endswith: '/logrotate'
  selection_truncate_cmd:
    type: EXECVE
    a0|endswith: '/truncate'
    a1|contains:
      - '/var/log/audit/'
      - '/var/log/auth.log'
      - '/var/log/secure'
  selection_shell_path:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
    a1: '-c'
    a2|contains:
      - '/var/log/audit/'
      - '/var/log/auth.log'
      - '/var/log/secure'
  selection_shell_truncmarker:
    a2|contains:
      - '>'
      - 'truncate'
      - '/dev/null'

  condition: (selection_syscall_delete and selection_log_path and not filter_logrotate) or selection_truncate_cmd or (selection_shell_path and selection_shell_truncmarker)

falsepositives:
  - 'Scheduled logrotate/log-shipping jobs deleting or truncating rotated files during their normal maintenance window; UserContext tuning should exclude the logrotate service account specifically.'
  - 'Administrative shell one-liners that legitimately grep, tail, or cat these log paths inside a bash -c "..." invocation may coincidentally include a truncation marker string (e.g. piping to a file); review argv content before escalating.'

level: critical

T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs

title: "T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs"
id: 62f50659-f193-4f3f-b2f3-ce887cce14be
description: 'Behavioral Detection of Log File Clearing on Linux and macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, LogFilePathPattern, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1685/006
author: Shahrukh Khan
date: 2026-05-02
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.006

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
  selection_target:
    CommandLine|contains:
      - '/var/log/'
      - '/private/var/log/'
  selection_op:
    CommandLine|contains: '>'
  selection2:
    Image|endswith: '/truncate'
    CommandLine|contains: '/var/log/'

  condition: (selection and selection_target and selection_op) or selection2

falsepositives:
  - Legitimate log rotation scripts or admin cleanup tasks that intentionally truncate or clear old log files during disk space maintenance.

level: high

Related sub-techniques

Explore