attack_technique: T1070.002
display_name: 'Indicator Removal on Host: Clear Linux or Mac System Logs'
atomic_tests:
- name: rm -rf
  auto_generated_guid: 989cc1b1-3642-4260-a809-54f9dd559683
  description: |
    Delete system and audit logs
  supported_platforms:
  - macos
  - linux
  executor:
    command: |
      sudo rm -rf /private/var/log/system.log*
      sudo rm -rf /private/var/audit/*
    name: sh
    elevation_required: true
- name: Overwrite Linux Mail Spool
  auto_generated_guid: 1602ff76-ed7f-4c94-b550-2f727b4782d4
  description: |
    This test overwrites the Linux mail spool of a specified user. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
  supported_platforms:
  - linux
  input_arguments:
    username:
      description: Username of mail spool
      type: String
      default: root
  executor:
    command: |
      echo 0> /var/spool/mail/#{username}
    name: bash
- name: Overwrite Linux Log
  auto_generated_guid: d304b2dc-90b4-4465-a650-16ddd503f7b5
  description: |
    This test overwrites the specified log. This technique was used by threat actor Rocke during the exploitation of Linux web servers.
  supported_platforms:
  - linux
  input_arguments:
    log_path:
      description: Path of specified log
      type: Path
      default: /var/log/secure
  executor:
    command: |
      echo 0> #{log_path}
    name: bash