CatalogLOOBins

ORCHARD · Tool

log

2 techniquesmacOSLOOBinsGPL-3.0

Remove all log messages

Defense EvasionmacOS

An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.

log erase --all
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion
Detection
No detections at time of publishing: No detections at time of publishing

Search log messages for tokens

Credential AccessmacOS

An attacker can potentially search log messages and review if they do contain sensitive information like jwt tokens.

log show --info --debug --predicate 'eventMessage CONTAINS[d] "eyJ"'
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Credential Access
Detection
No detections at time of publishing: No detections at time of publishing