macOS Indicator Removal: process deletion of local logs via rm/unlink/shred

Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.

FreeUnreviewedSigmamediumv1

macos-indicator-removal-process-deletion-of-local-logs-via-rm-unlink-shred-acf61bd8

title: "macOS Indicator Removal: process deletion of local logs via rm/unlink/shred"
id: d19e56cc-4926-4723-b226-2fd8c63dcf38
status: test
description: This rule catches macOS process executions where the command image name ends with rm, unlink, or shred and the command line references local log paths under /var/log or /Users/*/Library/Logs/. Attackers use log and artifact removal to impair forensic visibility and hinder detection after compromise. Telemetry relies on process creation events, specifically the executable path ending patterns and command-line path substrings identifying log locations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-09-16
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: macos
  category: process_creation
detection:
  selection1:
    Image|endswith:
      - /rm
      - /unlink
      - /shred
  selection_cli_1:
    CommandLine|contains: /var/log
  selection_cli_2:
    CommandLine|contains|all:
      - /Users/
      - /Library/Logs/
  condition: selection1 and 1 of selection_cli*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: acf61bd8-d814-4272-81f0-a7a269aa69aa
    type: derived

What it detects

This rule catches macOS process executions where the command image name ends with rm, unlink, or shred and the command line references local log paths under /var/log or /Users/*/Library/Logs/. Attackers use log and artifact removal to impair forensic visibility and hinder detection after compromise. Telemetry relies on process creation events, specifically the executable path ending patterns and command-line path substrings identifying log locations.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.