macOS System Log Deletion via Command Line
Detects attempts to clear macOS system logs by identifying common commands used for file deletion ('rm', 'unlink', 'shred') when targeting known log directories such as '/var/log' or user-specific '/Users/*/Library/Logs/'. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system.
Sigma
