BIOC
Informational
✕
Possible log destruction using the dd command
Possible destruction of system log files using the dd command.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Tampering
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
Indicator:
File action type = rename , write , create AND file path = /var/log/* Process initiated by = dd , cgo name = dd , os parent name = dd AND initiator cmd = *of=/var/log/* , cgo cmd = *of=/var/log/* , os parent cmd = *of=/var/log/* Host host os = linux
Preventable: no