Linux: Clear/Disable Kernel Ring Buffer via syslog Syscall (auditd a0=5/6)

title: "Linux: Clear/Disable Kernel Ring Buffer via syslog Syscall (auditd a0=5/6)"
id: 00d49b8c-a08b-49f5-b28f-61bf8245ca3a
status: experimental
description: This rule identifies the Linux syslog syscall invoked with audit argument codes that clear the kernel ring buffer or disable related logging (a0 values 4, 5, and 6). Attackers can use these actions to impair forensic visibility by removing or suppressing dmesg and kernel log output after compromise. Detection relies on auditd events that record syslog syscall executions and the specific syscall argument values.
references:
  - https://man7.org/linux/man-pages/man2/syslog.2.html
  - https://man7.org/linux/man-pages/man1/dmesg.1.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-27
modified: 2025-12-05
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs
    -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs
    -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs
detection:
  selection:
    type: SYSCALL
    SYSCALL: syslog
    a0:
      - 4
      - 5
      - 6
  condition: selection
falsepositives:
  - System administrators or scripts that intentionally clear logs
  - Debugging scripts
level: medium
license: DRL-1.1
related:
  - id: eca5e022-d368-4043-98e5-9736fb01f72f
    type: derived