#T1070.002 Clear Linux or Mac System Logs

Technique

  • Tactics: Defense Evasion
  • Description:

    Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the <code>/var/log/</code> directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)

    * <code>/var/log/messages:</code>: General and system-related messages
    * <code>/var/log/secure</code> or <code>/var/log/auth.log</code>: Authentication logs
    * <code>/var/log/utmp</code> or <code>/var/log/wtmp</code>: Login records
    * <code>/var/log/kern.log</code>: Kernel logs
    * <code>/var/log/cron.log</code>: Crond logs
    * <code>/var/log/maillog</code>: Mail server logs
    * <code>/var/log/httpd/</code>: Web server access and error logs

  • First Seen: Lazarus targets defense industry with ThreatNeedle • 2021-02-25
MITRE ATT&CK

Tagged Reports

2021-02-25
Kaspersky
#ThreatNeedle #Defense #Lazarus #T1090.001 #T1016 #T1104 #T1036.003 #T1560.001 #T1543.003 #T1132.002 #T1057 #T1082 #T1059.003 #T1070.002 #T1557.001 #T1572 #T1547.001 #T1135 #T1049 #T1140 #T1036.004 #T1070.004 #T1041 #T1070.003 #T1021.002 #T1204.002 #T1071.001 #T1112 #T1083 #T1007 #T1033 #T1566.002 #T1569.002
« Back