Created by Brendan Chamberlain (@infosecB)
The log command can be used to access system log messages from Apple Unified Logging (AUL). The tool can be used to inspect exiting logs, stream logs in realtime, and delete logs. This tool is normally used by system admins and application developers for troubleshooting purposes but can be used by an adversary to gain an understanding of the user’s behavior or to cover up their tracks by deleting log messages.
Remove all log messages
An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.
log erase --all
- No detections at time of publishing
- Daniel Stinson (@shellcromancer)