T1685.006: Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:[1]
* `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Security context for executives and security teams
Clearing Linux or macOS system logs is a defense-impairment behavior that can remove the evidence needed to understand an intrusion, prove scope, and support recovery decisions. For business leaders, the material issue is not just that logs were deleted; it is that incident responders may lose the timeline for authentication, kernel, cron, web, mail, and general system activity unless logs are protected off-host and monitored for tampering.
Executive priority
Prioritize this as an operational resilience and audit-evidence risk for Linux and macOS estates. Executives should ask whether critical endpoint and server logs under /var/log/ are centrally forwarded, protected from local tampering, and retained long enough to support investigations. This matters for incident decision-making because missing authentication or system logs can slow containment, weaken root-cause analysis, and reduce confidence in compliance or forensic evidence.
Technical view
This ATT&CK sub-technique applies to Linux and macOS under the defense-impairment tactic and is a sub-technique of Disable or Modify Tools. SOC and IR teams should validate monitoring around clearing, truncation, deletion, or abnormal modification of native system logs, especially /var/log/messages, /var/log/secure, /var/log/auth.log, /var/log/utmp, /var/log/wtmp, /var/log/kern.log, /var/log/cron.log, /var/log/maillog, and /var/log/httpd/ access or error logs. Relationship context includes ATT&CK detection strategy DET0520, Behavioral Detection of Log File Clearing on Linux and macOS, and mitigations focused on restricting file and directory permissions, remote data storage, and encrypting sensitive information.
Likely telemetry
- File creation, deletion, truncation, rename, and permission-change events for /var/log/ paths on Linux and macOS
- Endpoint process and command execution telemetry associated with log file modification activity
- Authentication and login record telemetry from /var/log/secure, /var/log/auth.log, /var/log/utmp, and /var/log/wtmp where available
- System, kernel, cron, mail, and web server log streams from the listed /var/log/ locations
- Centralized or remote log storage records that can show gaps, forwarding interruption, or mismatch with local logs
Detection direction
- Validate whether DET0520-style behavioral detection is implemented for log clearing on Linux and macOS rather than relying only on the logs that may be deleted locally.
- Tune alerts for suspicious deletion, truncation, or permission changes to sensitive log files and directories, while accounting for legitimate log rotation and administrative maintenance.
- Compare local log state with centrally stored copies to identify gaps, missing sequences, or unexpected changes after privileged activity.
- Pay special attention to authentication, login, kernel, cron, web, and mail logs because their removal can directly impair incident scoping.
- Use relationship context conservatively: ATT&CK lists multiple groups and software as using this behavior, but local prioritization should be driven by the organization’s Linux/macOS exposure and monitored services.
Mitigation priorities
- Restrict file and directory permissions so only required users, groups, or processes can write to sensitive system log locations.
- Forward critical logs to remote or centralized storage so evidence survives local tampering or host compromise.
- Protect sensitive log data at rest and in transit using appropriate encryption controls where supported by the environment.
- Review administrative access paths to Linux and macOS systems because excessive local privilege increases the ability to modify or remove logs.
- Test incident-response playbooks for scenarios where local logs are missing and responders must rely on remote log stores or other telemetry.
Additional notes and limits
This object replaced the revoked T1070.002 entry for the same named behavior and is now modeled under defense impairment as T1685.006. The supplied relationships show use by several ATT&CK groups and software entries, including Rocke, TeamTNT, Sea Turtle, Salt Typhoon, Proton, MacMa, UPSTYLE, and JumbledPath, but those relationships should not be treated as evidence that any specific organization is targeted.
The official ATT&CK detection field for this object is not provided, so detection guidance is derived from the object description, listed log paths, tactic, platforms, and supplied relationships. Local validation is required to confirm which logs exist, which are collected, how log rotation behaves, and whether endpoint or centralized logging telemetry can observe tampering reliably.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:[1]
* `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1070.002 | Clear Linux or Mac System LogsSub-technique | Clear Linux or Mac System Logs revoked by this object. |
| Enterprise | T1685 | Disable or Modify Tools | This object subtechnique of Disable or Modify Tools. |
Groups, software, and campaigns
G1045: Salt Typhoon
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).[1][2]
G0106: Rocke
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]
G1041: Sea Turtle
Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.[1][2][3][4]
G0139: TeamTNT
TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]
S1164: UPSTYLE
S0279: Proton
S1016: MacMa
MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]
S1206: JumbledPath
JumbledPath is a custom-built utility written in GO that has been used by Salt Typhoon since at least 2024 for packet capture on remote Cisco devices. JumbledPath is compiled as an ELF binary using x86-64 architecture which makes it potentially useable across Linux operating systems and network devices from multiple vendors.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 090e53cc2daf… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Linux Logs
Marcel. (2018, April 19). 12 Critical Linux Log Files You Must be Monitoring. Retrieved March 29, 2020.
Open source URL - [2]Cisco Salt Typhoon FEB 2025
Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
Open source URL - [3]Volexity UPSTYLE 2024
Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
Open source URL - [4]objsee mac malware 2017
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
Open source URL - [5]ESET DazzleSpy Jan 2022
M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
Open source URL - [6]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [7]Hunt Sea Turtle 2024
Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.
Open source URL - [8]Aqua TeamTNT August 2020
Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.
Open source URL - [9]Linux Logs
Marcel. (2018, April 19). 12 Critical Linux Log Files You Must be Monitoring. Retrieved March 29, 2020.
Open source URL - [10]Linux Logs
Marcel. (2018, April 19). 12 Critical Linux Log Files You Must be Monitoring. Retrieved March 29, 2020.
Open source URL - [11]mitre-attackT1685.006Open source URL
- [12]mitre-attackT1685.006Open source URL
- [13]mitre-attackT1685.006Open source URL
- [14]Cisco Salt Typhoon FEB 2025
Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
Open source URL - [15]Volexity UPSTYLE 2024
Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.
Open source URL - [16]objsee mac malware 2017
Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
Open source URL - [17]ESET DazzleSpy Jan 2022
M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
Open source URL - [18]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [19]Hunt Sea Turtle 2024
Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.
Open source URL - [20]Cisco Salt Typhoon FEB 2025
Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.