Log deletion using the truncate command

BIOC Informational

Log deletion using the truncate command

Usage of the truncate utility using "-s 0" argument to clear log files.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Tampering
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)

Indicator:

Process action type = execution AND target process cmd = truncate*-s 0*log* AND target process cmd != */tmp/* AND target process name = truncate Host host os = linux

Preventable: yes