Indicator_Removal_On_Host.md

Indicator Removal on Host

MITRE ATT&CK Technique: T1070

Delete System Logs

rm -rf /private/var/log/system.log*

Delete BSM Audit Logs

rm -rf /private/var/audit/*