H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs

13 recorded

Relationships

mitigatesMitigation
mitigatesMitigation
revoked-byTechnique
subtechnique-ofTechnique
usesMalware
uses
from MacMa
Malware
uses
from Proton
Malware
uses
from Rocke
Group
usesGroup
usesGroup
uses
from TeamTNT
Group
uses
from UPSTYLE
Malware
2 external

References

mitre-attack
T1685.006
open
Linux Logs
https://www.eurovps.com/blog/important-linux-log-files-you-must-be-monitoring/
open