Access system log messages from Apple Unified Logging (AUL).
loglogSandbox: execFile · Timeout: 30s
security.defenseevasion.bypass credential.dump Remove all log messages: An attacker can cover up their tracks by removing all log messages using the following command. Requires root privileges.
log erase --allSearch log messages for tokens: An attacker can potentially search log messages and review if they do contain sensitive information like jwt tokens.
log show --info --debug --predicate 'eventMessage CONTAINS[d] "eyJ"'| Type | Rule / Indicator |
|---|---|
| other | No detections at time of publishing |
The log command can be used to access system log messages from Apple Unified Logging (AUL). The tool can be used to inspect existing logs, stream logs in realtime, and delete logs. This tool is normally used by system admins and application developers for troubleshooting purposes but can be used by an adversary to gain an understanding of the user's behavior or to cover up their tracks by deleting log messages.