huntrule

Linux Commands Clearing or Removing /var/log/syslog

Flags Linux activity that clears, deletes, or redirects /var/log/syslog, a likely attempt to impair logging.

FreeReviewedSigma · High · v3
Product
linux
Author
Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-09-10
Updated
2026-07-31
AnalysisDetection
title: Linux Commands Clearing or Removing /var/log/syslog
id: 6343c484-f7cc-45a2-bed5-a65afa2f4a2b
status: test
description: This rule flags Linux shell activity that removes or empties the system syslog file by matching common destructive commands targeting /var/log/syslog. Attackers may use this to hinder forensics by deleting or overwriting logging traces. The detection relies on process or command-line telemetry that captures the executed command strings.
references:
  - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_clear_syslog.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-09-10
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  product: linux
detection:
  selection:
    - rm /var/log/syslog
    - rm -r /var/log/syslog
    - rm -f /var/log/syslog
    - rm -rf /var/log/syslog
    - mv /var/log/syslog
    - " >/var/log/syslog"
    - " > /var/log/syslog"
  falsepositives:
    - /syslog.
  condition: selection and not falsepositives
falsepositives:
  - Log rotation
level: high
license: DRL-1.1
related:
  - id: e09eb557-96d2-4de9-ba2d-30f712a5afd3
    type: derived