Syslog Clearing or Removal Via System Utilities

 1title: Syslog Clearing or Removal Via System Utilities
 2id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
 3status: test
 4description: |
 5        Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
 6references:
 7    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
 8    - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
 9author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
10date: 2021-10-15
11modified: 2025-10-15
12tags:
13    - attack.defense-evasion
14    - attack.t1070.002
15logsource:
16    product: linux
17    category: process_creation
18detection:
19    selection_file:
20        CommandLine|contains: '/var/log/syslog'
21    selection_command_rm:
22        # Examples:
23        #   rm -f /var/log/syslog
24        Image|endswith: '/rm'
25        CommandLine|contains:
26            - ' -r '
27            - ' -f '
28            - ' -rf '
29            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
30    selection_command_unlink:
31        # Examples:
32        #   unlink /var/log/syslog
33        Image|endswith: '/unlink'
34    selection_command_mv:
35        # Examples:
36        #   mv /var/log/syslog
37        Image|endswith: '/mv'
38    selection_command_truncate:
39        # Examples:
40        #   truncate --size 0 /var/log/syslog
41        Image|endswith: '/truncate'
42        CommandLine|contains|all:
43            - '0 '
44            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
45        CommandLine|contains:
46            - '-s '
47            - '-c '
48            - '--size'
49    selection_command_ln:
50        # Examples:
51        #   ln -sfn /dev/null /var/log/syslog
52        Image|endswith: '/ln'
53        CommandLine|contains|all:
54            - '/dev/null '
55            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
56        CommandLine|contains:
57            - '-sf '
58            - '-sfn '
59            - '-sfT '
60    selection_command_cp:
61        # Examples:
62        #   cp /dev/null /var/log/syslog
63        Image|endswith: '/cp'
64        CommandLine|contains: '/dev/null'
65    selection_command_shred:
66        # Examples:
67        #   shred -u /var/log/syslog
68        Image|endswith: '/shred'
69        CommandLine|contains: '-u '
70    selection_unique_other:
71        CommandLine|contains:
72            - ' > /var/log/syslog'
73            - ' >/var/log/syslog'
74            - ' >| /var/log/syslog'  # redirection empties w spacing, noclobber
75            - ': > /var/log/syslog'
76            - ':> /var/log/syslog'
77            - ':>/var/log/syslog'
78            - '>|/var/log/syslog'
79    selection_unique_journalctl:
80        CommandLine|contains:
81            - 'journalctl --vacuum'
82            - 'journalctl --rotate' # archives current journal files and creates new empty ones
83    condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
84falsepositives:
85    - Log rotation.
86    - Maintenance.
87level: high