tfMITRE ATT&CK sub-technique

Clear Linux or Mac System Logs T1685.006

sub-technique of T1685 Disable or Modify Tools

Tactic: Defense Impairment
Platforms: Linux, macOS
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Clear Linux or Mac System Logs MITRE reference T1685.006

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Salt TyphoonG1045 ↗

Has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.1

created 2025-02-241 reference

Sea TurtleG1041 ↗

Has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.1

created 2024-11-201 referenceaka Teal Kurma

TeamTNTG0139 ↗

Has removed system logs from /var/log/syslog.1

created 2021-10-011 reference

RockeG0106 ↗

Has cleared log files within the /var/log/ folder.1

created 2020-05-261 reference

All 4 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

JumbledPathS1206 ↗

Can clear logs on all devices used along its connection path to compromised network infrastructure.1

created 2025-02-25MALWAREcarried by 1 group

UPSTYLES1164 ↗

Clears error logs after reading embedded commands for execution.1

created 2024-11-20MALWARE

MacMaS1016 ↗

Can clear possible malware traces such as application logs.1

created 2022-05-06MALWAREcarried by 1 group

ProtonS0279 ↗

Removes logs from /var/logs and /Library/logs.1

created 2018-10-17MALWARE

All 4 software entries for this technique

Offense vs defense T1685.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2020 Q4

Clear Linux or Mac System Logs detection strategy DET0520

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Log File Clearing on Linux and macOS

Enterprise

2 platforms

AN1438 · Linux

Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File DeletionDC0040	auditd:SYSCALL	PATH

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	The time window used to correlate log file interaction and suspicious command execution.
LogFilePathPattern	Regex pattern used to match monitored log file paths (e.g., /var/log/auth.log).
UserContext	User or group (e.g., root) that should trigger higher severity detection.

AN1439 · macOS

Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process
File ModificationDC0061	fs:fsusage	truncate, unlink, write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Duration in which process activity and file I/O should be temporally linked.
LogFilePathPattern	Tunable path filter for macOS logs such as /var/log/system.log or /var/log/asl.log.
UserContext	Detects higher risk when log deletion is performed by unusual users (e.g., interactive vs. system users).

Tests20Executorssh 18 · bash 2Need elevation20 of 20Have prerequisites11Have cleanup1Platformsmacos, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

rm -rf

macos, linux

Required

—

Delete system and audit logs

Input arguments

Name	Type	Default	Description
syslog_path	string	/var/log/system.log	path of syslog file to delete. On macos it's /var/log/system.log, on linux, it's /var/log/syslog. Also note for File events, that on macos, /var/ is a link to /private/var/.
macos_audit_path	string	/var/audit/20220725213300.202208110700021	path of audit file to delete

Attack command

sudo rm -rf #{syslog_path}
if [ -d /var/audit ] ; then sudo rm -rf #{macos_audit_path} ; fi

Prerequisite

target files must exist

Check

if [ -d /var/audit ] ; then stat #{macos_audit_path} ; fi && stat #{syslog_path}

Satisfy

touch #{syslog_path}
if [ -d /var/audit ] ; then touch #{macos_audit_path} ; fi

GUIDa401d4e1-c921-4c73-9141-d498d64989e3

rm -rf

linux

Required

—

Delete log files using built-in log utility

macos

Required

—

Truncate system log files via truncate utility

macos

Required

—

This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path of system log to delete.

Attack command

sudo truncate -s 0 #{system_log_path} #size parameter shorthand

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUIDc5bb1ed5-30ce-49f1-b0d9-eb2b9bad6fdb

Truncate system log files via truncate utility (freebsd)

linux

Required

—

Delete log files via cat utility by appending /dev/null or /dev/zero

macos

Required

—

The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path of system log to delete.

Attack command

sudo cat /dev/null > #{system_log_path} #truncating the file to zero bytes
sudo dd if=/dev/zero bs=1000 count=5 of=#{system_log_path} #log file filled with null bytes(zeros)

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUIDf874903c-0c4a-4d43-a7d8-00ec123b3c74

Delete log files via cat utility by appending /dev/null or /dev/zero (freebsd)

linux

Required

—

System log file deletion via find utility

macos

Required

—

This test finds and deletes the system log files within /var/log/ directory using various executions(rm, shred, unlink)

Input arguments

Name	Type	Default	Description
system_log_name1	string	system.log	name or prefix of system log to delete.
system_log_name2	string	system.log.97.gz	name or prefix of system log to delete.
system_log_name3	string	system.log.98.gz	name or prefix of system log to delete.

Attack command

sudo find /var/log -name '#{system_log_name1}*' -exec rm {} \; #using "rm" execution
sudo find /var/log -name "#{system_log_name2}*" -exec shred -u -z -n 3 {} \; #using "shred" execution
sudo find /var/log -name "#{system_log_name3}*" -exec unlink {} \; #using "unlink" execution

Prerequisite

target files must exist

Check

stat /var/log/#{system_log_name1} /var/log/#{system_log_name2} /var/log/#{system_log_name3}

Satisfy

touch /var/log/#{system_log_name1} /var/log/#{system_log_name2} /var/log/#{system_log_name3}

GUIDb24d846a-5488-485e-9933-a1287c15de37

Overwrite macOS system log via echo utility

macos

Required

—

This test overwrites the contents of system log file with an empty string using echo utility

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log

Attack command

sudo echo '' > #{system_log_path}

GUID27c4ee65-7dd4-4c4a-803e-faecda9f61d7

Overwrite FreeBSD system log via echo utility

linux

Required

—

Real-time system log clearance/deletion

macos

Required

—

Delete system log files via unlink utility

macos

Required

—

This test deletes the system log file using unlink utility

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log

Attack command

sudo unlink #{system_log_path}

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUID01525983-47ec-4f33-b2a1-f8c84ba3f7eb

Delete system log files via unlink utility (freebsd)

linux

Required

—

Delete system log files using shred utility

macos

Required

—

This test overwrites the contents of the log file with zero bytes(-z) using three passes(-n 3) of data, and then delete the file(-u) securely

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log

Attack command

sudo shred -u -z -n 3 #{system_log_path}

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUIDb1ded172-294e-4e39-92d3-387ab4ad4e23

Delete system log files using srm utility

macos

Required

—

This test securely deletes the system log files individually and recursively using the srm utility. Install srm using Homebrew with the command: brew install khell/homebrew-srm/srm Refer: https://github.com/khell/homebrew-srm/issues/1 for installation

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log
system_log_folder	string	/var/log/	path to log parent folder

Attack command

sudo srm #{system_log_path} #system log file deletion
sudo srm -r #{system_log_folder} #recursive deletion of log files

Prerequisite

target files must exist

Check

stat #{system_log_path} #{system_log_folder}

Satisfy

mkdir -p #{system_log_folder} && touch #{system_log_path} #{system_log_folder}/system.log

GUIDa3a60728-2253-45f8-9324-1ade3f075828

Delete system log files using OSAScript

macos

Required

—

This test deletes the system log file using osascript via "do shell script"(sh/bash by default) which in-turn spawns rm utility, requires admin privileges

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log

Attack command

osascript -e 'do shell script "rm #{system_log_path}" with administrator privileges'

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUIDe70dea06-4e17-4d25-b62a-91820656c805

Delete system log files using Applescript

macos

Required

—

This test deletes the system log file using applescript using osascript via Finder application Note: The user may be prompted to grant access to the Finder application before the command can be executed successfully as part of TCC(Transparency, Consent, and Control) Framework. Refer: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive

Input arguments

Name	Type	Default	Description
system_log_path	string	/var/log/system.log	path to system.log

Attack command

osascript -e 'tell application "Finder" to delete POSIX file "#{system_log_path}"'

Prerequisite

target files must exist

Check

stat #{system_log_path}

Satisfy

touch #{system_log_path}

GUID69fccc56-804c-4a97-96c4-16102fb8ed98

Delete system journal logs via rm and journalctl utilities

linux

Required

—

The first sub-test deletes the journal files using rm utility in the "/var/log/journal/" directory and the second sub-test clears the journal by modifiying time period of logs that should be retained to zero.

Input arguments

Name	Type	Default	Description
journal_folder	string	/var/log/journal	path to journal logs

Attack command

sudo rm #{journal_folder}/* #physically deletes the journal files, and not just their content
sudo journalctl --vacuum-time=0 #clears the journal while still keeping the journal files in place

Prerequisite

target files must exist

Check

stat #{journal_folder}

Satisfy

mkdir -p #{journal_folder} && touch #{journal_folder}/T1685_006.journal

GUID9fe454fb-e467-479c-b4cc-37ca03951889

Overwrite Linux Mail Spool

linux

bash

Required

—

This test overwrites the Linux mail spool of a specified user. This technique was used by threat actor Rocke during the exploitation of Linux web servers.

Input arguments

Name	Type	Default	Description
username	string	root	Username of mail spool

Attack command

echo 0> /var/spool/mail/#{username}

Prerequisite

target files must exist

Check

stat /var/spool/mail/#{username}

Satisfy

touch /var/spool/mail/#{username}

GUID09a368a5-a828-4405-b029-318b3ab90b82

Overwrite Linux Log

linux

bash

Required

—

Yes

This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.

Input arguments

Name	Type	Default	Description
log_path	path	/var/log/secure	Path of specified log

Attack command

echo 0> #{log_path}

Cleanup command

if [ "/var/log/secure" != "#{log_path}" ] ; then rm -f #{log_path} ; fi

GUID3729dc67-6772-45a6-b278-64c51f38cbc2

Tests from Atomic Red Team (MIT licence) · technique definition

Clear Linux or Mac System Logs detections T1685.006

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs