Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
shelevatedmacos, linuxrm -rf
Delete system and audit logs
sudo rm -rf #{syslog_path}
if [ -d /var/audit ] ; then sudo rm -rf #{macos_audit_path} ; fi
shelevatedlinuxrm -rf
Delete messages and security logs
rm -rf /var/log/messages
rm -rf /var/log/security
shelevatedmacosDelete log files using built-in log utility
This test deletes main log datastore, inflight log data, time-to-live data(TTL), fault and error content
sudo log erase --all
sudo log erase --ttl #Deletes only time-to-live log content
shelevatedmacosTruncate system log files via truncate utility
This test truncates the system log files using the truncate utility with (-s 0) parameter which sets file size to zero, thus emptying the file content
sudo truncate -s 0 #{system_log_path} #size parameter shorthand
shelevatedlinuxTruncate system log files via truncate utility (freebsd)
This test truncates the system log files using the truncate utility with (-s 0 or --size=0) parameter which sets file size to zero, thus emptying the file content
truncate -s 0 /var/log/messages #size parameter shorthand
truncate --size=0 /var/log/security #size parameter
shelevatedmacosDelete log files via cat utility by appending /dev/null or /dev/zero
The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility
sudo cat /dev/null > #{system_log_path} #truncating the file to zero bytes
sudo dd if=/dev/zero bs=1000 count=5 of=#{system_log_path} #log file filled with null bytes(zeros)
shelevatedlinuxDelete log files via cat utility by appending /dev/null or /dev/zero (freebsd)
The first sub-test truncates the log file to zero bytes via /dev/null and the second sub-test fills the log file with null bytes(zeroes) via /dev/zero, using cat utility
cat /dev/null > /var/log/messages #truncating the file to zero bytes
cat /dev/zero > /var/log/messages #log file filled with null bytes(zeros)
shelevatedmacosSystem log file deletion via find utility
This test finds and deletes the system log files within /var/log/ directory using various executions(rm, shred, unlink)
sudo find /var/log -name '#{system_log_name1}*' -exec rm {} \; #using "rm" execution
sudo find /var/log -name "#{system_log_name2}*" -exec shred -u -z -n 3 {} \; #using "shred" execution
sudo find /var/log -name "#{system_log_name3}*" -exec unlink {} \; #using "unlink" execution
shelevatedmacosOverwrite macOS system log via echo utility
This test overwrites the contents of system log file with an empty string using echo utility
sudo echo '' > #{system_log_path}
shelevatedlinuxOverwrite FreeBSD system log via echo utility
This test overwrites the contents of system log file with an empty string using echo utility
echo '' > /var/log/messages
shelevatedmacosReal-time system log clearance/deletion
This test reads real-time system log file and writes empty string to it, thus clearing the log file without tampering with the logging process
sudo log -f /var/log/system.log | : > /var/log/system.log
shelevatedmacosDelete system log files via unlink utility
This test deletes the system log file using unlink utility
sudo unlink #{system_log_path}
shelevatedlinuxDelete system log files via unlink utility (freebsd)
This test deletes the messages log file using unlink utility
unlink /var/log/messages
shelevatedmacosDelete system log files using shred utility
This test overwrites the contents of the log file with zero bytes(-z) using three passes(-n 3) of data, and then delete the file(-u) securely
sudo shred -u -z -n 3 #{system_log_path}
shelevatedmacosDelete system log files using srm utility
This test securely deletes the system log files individually and recursively using the srm utility.
Install srm using Homebrew with the command: brew install khell/homebrew-srm/srm
Refer: https://github.com/khell/homebrew-srm/issues/1 for installation
sudo srm #{system_log_path} #system log file deletion
sudo srm -r #{system_log_folder} #recursive deletion of log files
shelevatedmacosDelete system log files using OSAScript
This test deletes the system log file using osascript via "do shell script"(sh/bash by default) which in-turn spawns rm utility, requires admin privileges
osascript -e 'do shell script "rm #{system_log_path}" with administrator privileges'
shelevatedmacosDelete system log files using Applescript
This test deletes the system log file using applescript using osascript via Finder application
Note: The user may be prompted to grant access to the Finder application before the command can be executed successfully as part of TCC(Transparency, Consent, and Control) Framework.
Refer: https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive
osascript -e 'tell application "Finder" to delete POSIX file "#{system_log_path}"'
shelevatedlinuxDelete system journal logs via rm and journalctl utilities
The first sub-test deletes the journal files using rm utility in the "/var/log/journal/" directory and the second sub-test clears the journal by modifiying time period of logs that should be retained to zero.
sudo rm #{journal_folder}/* #physically deletes the journal files, and not just their content
sudo journalctl --vacuum-time=0 #clears the journal while still keeping the journal files in place
bashelevatedlinuxOverwrite Linux Mail Spool
This test overwrites the Linux mail spool of a specified user. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
echo 0> /var/spool/mail/#{username}
bashelevatedlinuxOverwrite Linux Log
This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
echo 0> #{log_path}