Commands to Clear or Remove the Syslog

calendar Jun 24, 2025 · attack.defense-evasion attack.t1070.002  ·
Share on: linkedin copy

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

Sigma rule (View on GitHub)

 1title: Commands to Clear or Remove the Syslog
 2id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
 3status: test
 4description: Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
 7    - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
 8author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
 9date: 2021-10-15
10modified: 2024-10-14
11tags:
12    - attack.defense-evasion
13    - attack.t1070.002
14logsource:
15    product: linux
16    category: process_creation
17detection:
18    selection:
19        CommandLine|contains:
20            - 'rm /var/log/syslog'
21            - 'rm -r /var/log/syslog'
22            - 'rm -f /var/log/syslog'
23            - 'rm -rf /var/log/syslog'
24            - 'unlink /var/log/syslog'
25            - 'unlink -r /var/log/syslog'
26            - 'unlink -f /var/log/syslog'
27            - 'unlink -rf /var/log/syslog'
28            - 'mv /var/log/syslog'
29            - ' >/var/log/syslog'
30            - ' > /var/log/syslog'
31            - 'journalctl --vacuum'
32    condition: selection
33falsepositives:
34    - Log rotation.
35level: high

References

Related rules

to-top