macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of rm, unlink, or shred on macOS when the command line includes local log directory paths such as /var/log or /Users/.../Library/Logs/. Attackers may remove or destroy logging material to impair detection and reduce forensics after compromise. Telemetry required includes macOS process creation events with the executable path and full command line.

Reporting behind it

Related detections9 linkedT1685.006 — drag to rearrange

Suspicious Deletion of System Logs Under var log on Linux Appliance

Suspicious Clearing of System Logs on Linux (via process_creation)

Malicious Sed Tampering of Juniper Syslog Configuration by UNC3886 (via process_creation)

Suspicious Clearing of Linux Authentication and History Logs

Suspicious Linux Log Sanitization via sed In-Place Edit

Suspicious utmpdump Usage for wtmp Log Manipulation

Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)

Linux Syslog Clearing or Removal Using System Utilities

Linux process attempts to delete log files using rm, rmdir, shred, or unlink

macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths

Pivot detection · T1685.006 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-indicator-removal-process-deletion-of-local-logs-via-rm-unlink-shred-acf61bd8

title: macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths
id: d19e56cc-4926-4723-b226-2fd8c63dcf38
status: test
description: This rule flags process executions of rm, unlink, or shred on macOS when the command line includes local log directory paths such as /var/log or /Users/.../Library/Logs/. Attackers may remove or destroy logging material to impair detection and reduce forensics after compromise. Telemetry required includes macOS process creation events with the executable path and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_clear_system_logs.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-09-16
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: macos
  category: process_creation
detection:
  selection1:
    Image|endswith:
      - /rm
      - /unlink
      - /shred
  selection_cli_1:
    CommandLine|contains: /var/log
  selection_cli_2:
    CommandLine|contains|all:
      - /Users/
      - /Library/Logs/
  condition: selection1 and 1 of selection_cli*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: acf61bd8-d814-4272-81f0-a7a269aa69aa
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL