Linux Commands Clearing or Removing /var/log/syslog
Flags Linux activity that clears, deletes, or redirects /var/log/syslog, a likely attempt to impair logging.
FreeReviewedSigma · High · v3
- Product
- linux
- Author
- Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-09-10
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Linux shell activity that removes or empties the system syslog file by matching common destructive commands targeting /var/log/syslog. Attackers may use this to hinder forensics by deleting or overwriting logging traces. The detection relies on process or command-line telemetry that captures the executed command strings.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-commands-clearing-or-removing-var-log-syslog-e09eb557
title: Linux Commands Clearing or Removing /var/log/syslog
id: 6343c484-f7cc-45a2-bed5-a65afa2f4a2b
status: test
description: This rule flags Linux shell activity that removes or empties the system syslog file by matching common destructive commands targeting /var/log/syslog. Attackers may use this to hinder forensics by deleting or overwriting logging traces. The detection relies on process or command-line telemetry that captures the executed command strings.
references:
- https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_clear_syslog.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-09-10
modified: 2022-11-26
tags:
- attack.impact
- attack.t1565.001
logsource:
product: linux
detection:
selection:
- rm /var/log/syslog
- rm -r /var/log/syslog
- rm -f /var/log/syslog
- rm -rf /var/log/syslog
- mv /var/log/syslog
- " >/var/log/syslog"
- " > /var/log/syslog"
falsepositives:
- /syslog.
condition: selection and not falsepositives
falsepositives:
- Log rotation
level: high
license: DRL-1.1
related:
- id: e09eb557-96d2-4de9-ba2d-30f712a5afd3
type: derived