Threat Actors may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.