Disable or Modify Tools: Clear Linux or Mac System Logs
- ID
- T1685.006
- Tactics
- TA0112 Defense Impairment
- Sub-technique of
- T1685 Disable or Modify Tools
- Platforms
- Linux, macOS
- Data sources
- Process Creation, File Deletion, File Modification
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:[1]
/var/log/messages:: General and system-related messages/var/log/secure or /var/log/auth.log: Authentication logs/var/log/utmp or /var/log/wtmp: Login records/var/log/kern.log: Kernel logs/var/log/cron.log: Crond logs/var/log/maillog: Mail server logs/var/log/httpd/: Web server access and error logs
Detection
- DET0520 Behavioral Detection of Log File Clearing on Linux and macOS
Data components: Process Creation, File Deletion, File Modification
Mitigations (3)
- M1022 Restrict File and Directory Permissions
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
- M1029 Remote Data Storage
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
- M1041 Encrypt Sensitive Information
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.