Linux process activity clearing logs with rm, rmdir, shred, or unlink targeting /var/log

Flags Linux attempts to remove or destroy log files via rm/rmdir/shred/unlink when /var/log or mail spool paths are referenced.

FreeUnreviewedSigmamediumv1

linux-process-activity-clearing-logs-with-rm-rmdir-shred-or-unlink-targeting-var-80915f59

title: Linux process activity clearing logs with rm, rmdir, shred, or unlink targeting /var/log
id: 0617044c-186e-467e-9f1a-ad5df9f1591b
status: stable
description: This rule identifies Linux process executions where the command path ends with rm, rmdir, shred, or unlink and the command line includes common log locations like /var/log and /var/spool/mail. Such activity can be used to impair forensic visibility by removing or destroying evidence after malicious or unauthorized actions. It relies on Linux process creation telemetry, matching the executable name and the presence of relevant filesystem paths in the command line, with exclusions for specific rm usage patterns targeting sysstat and dmesg logs.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2026-03-18
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /rm
      - /rmdir
      - /shred
      - /unlink
    CommandLine|contains:
      - /var/log
      - /var/spool/mail
  filter_main_legit_systat:
    Image|endswith: /rm
    CommandLine|startswith: rm -f /var/log/sysstat/
  filter_main_dmseg:
    Image|endswith: /rm
    CommandLine|startswith: rm -f -- /var/log//dmesg
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 80915f59-9b56-4616-9de0-fd0dea6c12fe
    type: derived

What it detects

This rule identifies Linux process executions where the command path ends with rm, rmdir, shred, or unlink and the command line includes common log locations like /var/log and /var/spool/mail. Such activity can be used to impair forensic visibility by removing or destroying evidence after malicious or unauthorized actions. It relies on Linux process creation telemetry, matching the executable name and the presence of relevant filesystem paths in the command line, with exclusions for specific rm usage patterns targeting sysstat and dmesg logs.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.