huntrule

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Flags Cisco network OS attempts to clear logs or archives via AAA command text.

FreeReviewedSigma · High · v2
Product
cisco
Service
aaa
Author
Austin Clark (SigmaHQ), DRL 1.1
Published
2019-08-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags attempts to clear logging and related archives on Cisco network operating systems by matching command text such as "clear logging" and "clear archive". Attackers may use these actions to reduce available forensic evidence after malicious activity. Detection relies on AAA-related command/management telemetry that records the executed command content.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange
Suspicious Shell History Clearing or Disabling (via process_creation)
Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)
Suspicious File Immutability Set via chattr for Anti-Removal on Linux
Suspicious Clearing of Linux Authentication and History Logs
Windows Registry RunMRU Key Deletion
Windows: Detect reg.exe Deletion of RunMRU Registry Key
Windows PowerShell Command History Disable via Remove-Module psreadline
Windows PowerShell Clears Console History via Clear-History
Cisco Network OS Log and Archive Clearing via “clear logging” Commands
Pivot detection · T1070.003 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.