AN1439: Analytic 1439
Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).
Analyst context for executives and security teams
This analytic matters because clearing macOS log files can remove evidence needed to understand an incident, prove control performance, and restore trust in affected systems. The supplied ATT&CK object focuses on detecting shell utilities such as echo redirection, rm, or truncate when they target /var/log/ in suspicious context, such as a non-administrative user or abnormal process lineage.
Executive priority
Prioritize this as an evidence-preservation and incident-readiness control for macOS environments. Leaders should ask whether endpoint logging captures command execution, user context, process lineage, and changes to /var/log/ files, and whether those events are retained outside the endpoint so local log clearing does not erase the investigation trail.
Technical view
For SOC and detection engineering teams, validate macOS telemetry that can correlate shell utility execution with target paths under /var/log/ and context such as user privilege level and parent-child process lineage. Because the object does not specify tactics or related techniques, treat this as a focused detection analytic rather than a complete behavior model. Test against legitimate administrative activity such as maintenance scripts and log rotation to establish baselines and reduce false positives.
Likely telemetry
- macOS process execution events
- Command-line arguments showing shell utilities or redirection patterns
- File deletion, truncation, or overwrite activity involving /var/log/
- User identity and administrative privilege context
- Parent and child process lineage
Detection direction
- Correlate shell utilities such as rm and truncate, and shell redirection patterns such as echo >, with files under /var/log/.
- Prioritize alerts when the actor is a non-administrative user or the process lineage is unusual for the environment.
- Tune expected administrative workflows, log rotation, and approved maintenance scripts to reduce noisy detections.
- Confirm telemetry is collected before local log clearing can remove the only evidence source.
- Review alert context for whether the command targeted logs specifically, not just any file operation.
Mitigation priorities
- Centralize or forward relevant macOS security and endpoint telemetry so evidence is not dependent only on local /var/log/ files.
- Limit administrative privileges and validate that non-administrative users cannot modify protected log locations except where explicitly required.
- Review filesystem permissions and operational processes around macOS log maintenance.
- Document expected log rotation and maintenance behavior so SOC teams can distinguish routine activity from abnormal clearing.
- Include log-clearing evidence preservation in incident response playbooks for macOS systems.
Analyst notes and limits
This Glexia take is based on the supplied MITRE analytic description for AN1439. The object is a detection analytic for macOS and describes correlation of shell utility activity against /var/log/ with unusual context. No relationships, aliases, labels, tactics, or official detection implementation were supplied.
The source does not provide a full detection query, ATT&CK tactic mapping, related techniques, adversary attribution, or evidence of active exploitation. Local baselines are required to determine what process lineage, user context, and log-maintenance behavior are abnormal in a specific environment.
Analytic 1439
Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 1eb8dfabfe15… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1439Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.