Skip to content

T1070.002 Clear Linux or Mac System Logs

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:1

  • /var/log/messages:: General and system-related messages
  • /var/log/secure or /var/log/auth.log: Authentication logs
  • /var/log/utmp or /var/log/wtmp: Login records
  • /var/log/kern.log: Kernel logs
  • /var/log/cron.log: Crond logs
  • /var/log/maillog: Mail server logs
  • /var/log/httpd/: Web server access and error logs
Item Value
ID T1070.002
Sub-techniques T1070.001, T1070.002, T1070.003, T1070.004, T1070.005, T1070.006, T1070.007, T1070.008, T1070.009, T1070.010
Tactics TA0005
Platforms Linux, macOS
Version 1.0
Created 28 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1206 JumbledPath JumbledPath can clear logs on all devices used along its connection path to compromised network infrastructure.3
S1016 MacMa MacMa can clear possible malware traces such as application logs.4
S0279 Proton Proton removes logs from /var/logs and /Library/logs.5
G0106 Rocke Rocke has cleared log files within the /var/log/ folder.8
G1045 Salt Typhoon Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.3
G1041 Sea Turtle Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.6
G0139 TeamTNT TeamTNT has removed system logs from /var/log/syslog.7
S1164 UPSTYLE UPSTYLE clears error logs after reading embedded commands for execution.2

Mitigations

ID Mitigation Description
M1041 Encrypt Sensitive Information Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
M1029 Remote Data Storage Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
M1022 Restrict File and Directory Permissions Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

References

  1. Marcel. (2018, April 19). 12 Critical Linux Log Files You Must be Monitoring. Retrieved March 29, 2020. ↩

  2. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024. ↩

  3. Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025. ↩↩

  4. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022. ↩

  5. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018. ↩

  6. Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024. ↩

  7. Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021. ↩

  8. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩