Disable or Modify Tools — Clear Linux or Mac System Logs

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileDeleted", "FileModified", "FileTruncated")
| where FolderPath startswith "/var/log/" or FolderPath startswith "/Library/Logs/" or FolderPath startswith "/private/var/log/"
| where FileName endswith ".log" or FileName in~ ("auth.log", "syslog", "messages", "secure", "wtmp", "btmp", "lastlog", "kern.log")
| where not(InitiatingProcessFileName in~ ("logrotate", "newsyslog", "rsyslog", "syslogd"))
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
         ActionType, FileName, FolderPath, InitiatingProcessFileName,
         InitiatingProcessCommandLine
| sort by Timestamp desc

index=linux_auditd sourcetype="linux:audit" type=SYSCALL (syscall=unlink OR syscall=unlinkat OR syscall=truncate OR syscall=ftruncate OR syscall=open OR syscall=openat)
| rex field=msg_audit "name=\"(?<filepath>[^\"]+)\""
| where match(filepath, "(/var/log/|/Library/Logs/)")
| where match(filepath, "(\.log$|auth\.log|syslog|messages|secure|wtmp|btmp|lastlog|kern\.log)")
| where NOT match(exe, "(logrotate|rsyslog|syslogd|newsyslog)")
| eval ActionType=case(syscall="unlink" OR syscall="unlinkat", "FileDeleted", syscall="truncate" OR syscall="ftruncate", "FileTruncated", match(oflags, "O_TRUNC"), "FileTruncated", true(), "FileAccess")
| where ActionType in ("FileDeleted", "FileTruncated")
| table _time, host, auid, uid, exe, filepath, ActionType, syscall
| sort - _time

file where event.action in ("deletion", "overwrite", "truncation") and
(
  file.path like~ "/var/log/*" or
  file.path like~ "/Library/Logs/*" or
  file.path like~ "/private/var/log/*"
) and
(
  file.name like~ "*.log" or
  file.name in~ ("auth.log", "syslog", "messages", "secure", "wtmp", "btmp", "lastlog", "kern.log")
) and
not process.name in ("logrotate", "newsyslog", "rsyslog", "syslogd", "aslmanager", "logger")

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  username,
  "hostname" AS Host,
  "process_name" AS ProcessName,
  "filepath" AS FilePath,
  "syscall" AS Syscall,
  CATEGORYNAME(category) AS EventCategory
FROM events
WHERE LOGSOURCETYPEID IN (13, 88)
  AND (
    "syscall" IN ('unlink', 'unlinkat', 'truncate', 'ftruncate')
    OR ("syscall" IN ('open', 'openat') AND "oflags" LIKE '%O_TRUNC%')
  )
  AND (
    "filepath" LIKE '/var/log/%'
    OR "filepath" LIKE '/Library/Logs/%'
    OR "filepath" LIKE '/private/var/log/%'
  )
  AND (
    "filepath" LIKE '%.log'
    OR "filename" IN ('auth.log', 'syslog', 'messages', 'secure', 'wtmp', 'btmp', 'lastlog', 'kern.log')
  )
  AND "process_name" NOT IN ('logrotate', 'rsyslog', 'syslogd', 'newsyslog', 'aslmanager')
ORDER BY devicetime DESC
LAST 24 HOURS

_sourceCategory=linux/auditd OR _sourceCategory=linux/secure
| parse regex "type=SYSCALL\s.*?syscall=(?<syscall>\w+)" nodrop
| parse regex "name=\"(?<filepath>[^\"]+)\"" nodrop
| parse regex "exe=\"(?<exe>[^\"]+)\"" nodrop
| parse regex "auid=(?<auid>\d+)" nodrop
| parse regex "uid=(?<uid>\d+)" nodrop
| where syscall in ("unlink", "unlinkat", "truncate", "ftruncate", "open", "openat")
| where filepath matches "/var/log/*" or filepath matches "/Library/Logs/*" or filepath matches "/private/var/log/*"
| where filepath matches "*.log" or filepath in ["auth.log", "syslog", "messages", "secure", "wtmp", "btmp", "lastlog", "kern.log"]
| where !(exe matches "*logrotate*" or exe matches "*rsyslog*" or exe matches "*syslogd*" or exe matches "*newsyslog*")
| eval ActionType = if(syscall in ("unlink", "unlinkat"), "FileDeleted", if(syscall in ("truncate", "ftruncate"), "FileTruncated", "FileOpenTrunc"))
| fields _messageTime, _sourceHost, auid, uid, exe, filepath, ActionType, syscall
| sort by _messageTime desc

rule linux_mac_system_log_cleared {
  meta:
    author = "Detection Engineering"
    description = "Detects deletion or truncation of Linux and macOS system log files by unauthorized processes — T1070.002"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1070.002"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"

  events:
    (
      $e.metadata.event_type = "FILE_DELETION"
      or $e.metadata.event_type = "FILE_MODIFICATION"
    )
    re.regex($e.target.file.full_path, `/var/log/|/Library/Logs/|/private/var/log/`)
    (
      re.regex($e.target.file.full_path, `\.log$`)
      or re.regex($e.target.file.full_path, `(auth\.log|syslog|messages|secure|wtmp|btmp|lastlog|kern\.log)$`)
    )
    not re.regex($e.principal.process.file.full_path, `(logrotate|newsyslog|rsyslog|syslogd|aslmanager)$`)

  condition:
    $e
}

#event_simpleName = /^(FileDeleteInfo|PeFileWritten|EngineFileWritten)$/
| TargetFileName = /\/(var\/log|Library\/Logs|private\/var\/log)\//
| TargetFileName = /(\.log$|auth\.log|syslog|messages|secure|wtmp|btmp|lastlog|kern\.log)/
| CommandLine != /logrotate|newsyslog|rsyslog|syslogd|aslmanager/
| FileName != /logrotate|newsyslog|rsyslog|syslogd/
| select([timestamp, ComputerName, UserName, FileName, TargetFileName, CommandLine, #event_simpleName])
| sort(timestamp, order=desc)