log
Created by Brendan Chamberlain (@infosecB)
Description
The log command can be used to access system log messages from Apple Unified Logging (AUL). The tool can be used to inspect exiting logs, stream logs in realtime, and delete logs. This tool is normally used by system admins and application developers for troubleshooting purposes but can be used by an adversary to gain an understanding of the user’s behavior or to cover up their tracks by deleting log messages.
| Created | Tactics | Tags |
|---|---|---|
| 2023-06-06 | Defense Evasion | requires_root |
Paths
/usr/bin/log
Use Cases
Remove all log messages
An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.
log erase --all
Detections
- No detections at time of publishing
Resources
Acknowledgements
- Daniel Stinson (@shellcromancer)