{"id":"acf61bd8-d814-4272-81f0-a7a269aa69aa","title":"Indicator Removal on Host - Clear Mac System Logs","description":"Detects deletion of local audit logs","author":"remotephone, oscd.community","status":"test","level":"medium","date":"2020-10-11","modified":"2022-09-16","tags":["attack.defense-impairment","attack.t1685.006"],"technique_ids":["T1685.006"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md"],"source_path":"rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml","source_sha256":"cc89a855ced209444022cb9c8e6fc71f0173db5c8a9262aef07a4c3898752d0f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Indicator Removal on Host - Clear Mac System Logs\nid: acf61bd8-d814-4272-81f0-a7a269aa69aa\nstatus: test\ndescription: Detects deletion of local audit logs\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\nauthor: remotephone, oscd.community\ndate: 2020-10-11\nmodified: 2022-09-16\ntags:\n    - attack.defense-impairment\n    - attack.t1685.006\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection1:\n        Image|endswith:\n            - '/rm'\n            - '/unlink'\n            - '/shred'\n    selection_cli_1:\n        CommandLine|contains: '/var/log'\n    selection_cli_2:\n        CommandLine|contains|all:\n            - '/Users/'\n            - '/Library/Logs/'\n    condition: selection1 and 1 of selection_cli*\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","page":"techniques/enterprise/T1685.006/"}],"data_path":"data/detection-rules/acf61bd8-d814-4272-81f0-a7a269aa69aa.json","kind":"sigma"}