Clear Linux System Logs

id: '1141.1221'
title: Clear Linux System Logs
description: 'This use case would detect the alteration or removal of log files. Atomics
  T1070.003 Test #3 Atomics T1070.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle OR type=execve
  OR sourcetype=bash_history) AND ((TERM(vi) OR TERM(vim) OR TERM(nano) OR (TERM(echo)
  AND TERM(>)) OR TERM(visudo) OR TERM(rm) OR (TERM(dd) AND TERM(if)) OR (TERM(cat)
  AND "/dev/null") OR (TERM(truncate) AND TERM(0)) OR (TERM(tee) AND NOT TERM(-a))
  OR TERM(shred) OR TERM(wipe)) AND ("auth.log" OR TERM(faillog) OR TERM(secure) OR
  TERM(syslog) OR TERM(messages) OR TERM(utmp) OR TERM(wtmp) OR "kern.log" OR "audit.log"
  OR "cron.log" OR "error.log" OR "access.log" OR "boot.log" OR "mysqld.log" OR TERM(httpd)
  OR "yum.log")) OR TERM(covermyass) | rex field=_raw "(?i)proctitle=(\")?(?<proc>.+")|
  eval process=mvappend(process, proc) | regex process!="(?i)(\/)?(etc|home|opt|bin|sbin|dev|ext|lib|media|mnt|proc|root|sys|tmp|usr|boot)\/\w+"
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host | where match(process, "(?i)(vi|vim|nano|echo.*\>|visudo|rm|shred|wipe)\s")
  OR match(process, "(?i)dd\s.*if[^a-z0-9]") OR match(process, "(?i)truncate\s") OR
  (match(process, "(?i)tee") and not match(process, "(?i)tee\s.*-a")) '
techniques:
- defense-evasion:indicator removal:file deletion
- defense-evasion:indicator removal:clear linux or mac system logs
- defense-evasion:indicator removal:clear command history
technique_id:
- T1070.003
- T1070.002
- T1070.004
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://null-byte.wonderhowto.com/how-to/clear-logs-history-linux-systems-cover-your-tracks-remain-undetected-0244768/
- https://hackingpassion.com/clear-your-tracks-on-linux/
- https://null-byte.wonderhowto.com/forum/easily-cover-your-tracks-from-kali-linux-after-hacking-system-0205468/