Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)

Flags auditd syslog syscall actions that clear or suppress kernel ring buffer (dmesg) logs.

FreeReviewedSigma · Medium · v3

Product: linux
Service: auditd
Author: Milad Cheraghi (SigmaHQ), DRL 1.1
Published: 2025-05-27
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux syslog syscall executions where the syscall action code clears kernel ring buffer content or disables console logging. Attackers can use these operations to reduce or remove evidence from dmesg logs after exploitation or privilege escalation. The detection relies on auditd records capturing the syslog syscall with argument values matching actions 4, 5, and 6 on 32-bit or 64-bit architectures.

Reporting behind it

Related detections9 linkedT1685.006 — drag to rearrange

Malicious Sed Tampering of Ivanti Debug and Audit Logs (via process_creation)

Suspicious File Immutability Set via chattr to Resist Removal

Malicious Tampering of Linux Authentication Log var log secure (via process_creation)

Suspicious Shell History and Log Clearing on Linux

Suspicious Deletion of System Logs Under var log on Linux Appliance

Suspicious Clearing of System Logs on Linux (via process_creation)

Malicious Sed Tampering of Juniper Syslog Configuration by UNC3886 (via process_creation)

Suspicious Clearing of Linux Authentication and History Logs

Suspicious Linux Log Sanitization via sed In-Place Edit

Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)

Pivot detection · T1685.006 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-clear-disable-kernel-ring-buffer-via-syslog-syscall-auditd-a0-5-6-eca5e022

title: "Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)"
id: 00d49b8c-a08b-49f5-b28f-61bf8245ca3a
status: experimental
description: This rule flags Linux syslog syscall executions where the syscall action code clears kernel ring buffer content or disables console logging. Attackers can use these operations to reduce or remove evidence from dmesg logs after exploitation or privilege escalation. The detection relies on auditd records capturing the syslog syscall with argument values matching actions 4, 5, and 6 on 32-bit or 64-bit architectures.
references:
  - https://man7.org/linux/man-pages/man2/syslog.2.html
  - https://man7.org/linux/man-pages/man1/dmesg.1.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-27
modified: 2025-12-05
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs
    -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs
    -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs
    -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs
detection:
  selection:
    type: SYSCALL
    SYSCALL: syslog
    a0:
      - 4
      - 5
      - 6
  condition: selection
falsepositives:
  - System administrators or scripts that intentionally clear logs
  - Debugging scripts
level: medium
license: DRL-1.1
related:
  - id: eca5e022-d368-4043-98e5-9736fb01f72f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL