AN1438
Analytic 1438
Linux
Detects log-clearing behavior by correlating suspicious command execution targeting log files under /var/log/, anomalous deletions or truncations of system logs, and unusual child processes (e.g., shell pipelines or redirections).
auditd:SYSCALL
execve
auditd:SYSCALL
PATH
[TimeWindow]
The time window used to correlate log file interaction and suspicious command execution.
[LogFilePathPattern]
Regex pattern used to match monitored log file paths (e.g., /var/log/auth.log).
[UserContext]
User or group (e.g., root) that should trigger higher severity detection.
AN1439
Analytic 1439
macOS
Detects adversary clearing log files on macOS by correlating calls to shell utilities (e.g., echo >, rm, truncate) targeting files in /var/log/ with unusual context (non-administrative users or abnormal process lineage).
macos:unifiedlog
process
fs:fsusage
truncate, unlink, write
[TimeWindow]
Duration in which process activity and file I/O should be temporally linked.
[LogFilePathPattern]
Tunable path filter for macOS logs such as /var/log/system.log or /var/log/asl.log.
[UserContext]
Detects higher risk when log deletion is performed by unusual users (e.g., interactive vs. system users).