MacOS Log Removal

name: MacOS Log Removal
id: a7f2e891-3c4d-4a1b-9e6f-2b8d0c5a1f3e
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths.
    Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    
    from datamodel=Endpoint.Processes where
    
    Processes.process = "*system.log*"
    AND
    (
        (Processes.process = "*rm *")
        OR
        (
            Processes.process = "*audit*"
            Processes.process = "* -s *"
        )
    )
    
    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product
    
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_log_removal_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Legitimate log rotation or administrative cleanup of system or audit logs.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
finding:
    title: Log removal or modification on $dest$ by $user$
    entity:
        field: user
        type: user
        score: 55
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 55
          message: Log removal or modification on $dest$ by $user$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Post-Exploitation
asset_type: Endpoint
mitre_attack_id:
    - T1070
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint