Cisco Network OS Log and Archive Clearing via “clear logging” Commands

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070.003Clear Command History
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags attempts to clear logging and related archives on Cisco network operating systems by matching command text such as "clear logging" and "clear archive". Attackers may use these actions to reduce available forensic evidence after malicious activity. Detection relies on AAA-related command/management telemetry that records the executed command content.

Reporting behind it

Related detections8 linkedT1070.003 — drag to rearrange

Suspicious Shell History Clearing or Disabling (via process_creation)

Suspicious COLDRIVER RunMRU History Clearing via Reg Delete (via process_creation)

Suspicious File Immutability Set via chattr for Anti-Removal on Linux

Suspicious Clearing of Linux Authentication and History Logs

Windows Registry RunMRU Key Deletion

Windows: Detect reg.exe Deletion of RunMRU Registry Key

Windows PowerShell Command History Disable via Remove-Module psreadline

Windows PowerShell Clears Console History via Clear-History

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Pivot detection · T1070.003 · 8 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-network-os-clear-logging-commands-detected-aaa-ceb407f6

title: Cisco Network OS Log and Archive Clearing via “clear logging” Commands
id: 1a23fd42-5075-4264-afe6-0c5a2f85648e
status: test
description: This rule flags attempts to clear logging and related archives on Cisco network operating systems by matching command text such as "clear logging" and "clear archive". Attackers may use these actions to reduce available forensic evidence after malicious activity. Detection relies on AAA-related command/management telemetry that records the executed command content.
references:
  - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html
  - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_clear_logs.yml
author: Austin Clark, Huntrule Team
date: 2019-08-12
modified: 2023-05-26
tags:
  - attack.stealth
  - attack.t1070.003
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - clear logging
    - clear archive
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands
level: high
license: DRL-1.1
related:
  - id: ceb407f6-8277-439b-951f-e4210e3ed956
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL