T1685.006 Clear Linux or Mac System Logs — Detection Rules

Source-backed rule directory

• Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall · experimental · medium · {"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs\n-a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs\n-a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs\n"}
• Linux Logs Clearing Attempts · stable · medium · {"product":"linux","category":"process_creation"}
• Syslog Clearing or Removal Via System Utilities · test · high · {"product":"linux","category":"process_creation"}
• Indicator Removal on Host - Clear Mac System Logs · test · medium · {"product":"macos","category":"process_creation"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0520 Behavioral Detection of Log File Clearing on Linux and macOS

AN1438 Analytic 1438

Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).

AN1439 Analytic 1439

Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).