Linux Syslog File Clearing or Removal via Common System Utilities

title: Linux Syslog File Clearing or Removal via Common System Utilities
id: ede22a96-2bb0-4814-91cd-f3dafe290a3d
status: test
description: This rule flags Linux process executions that attempt to delete, unlink, move, truncate, or replace /var/log/syslog, as well as commands that redirect output to empty it. It also detects use of journalctl vacuum/rotate patterns that archive current journal files and create new empty ones. These actions can impair incident investigation by removing or hiding log evidence, relying on process creation telemetry including the executable path and command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
  - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml
author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2025-10-15
tags:
  - attack.defense-impairment
  - attack.t1685.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_file:
    CommandLine|contains: /var/log/syslog
  selection_command_rm:
    Image|endswith: /rm
    CommandLine|contains:
      - " -r "
      - " -f "
      - " -rf "
      - /var/log/syslog
  selection_command_unlink:
    Image|endswith: /unlink
  selection_command_mv:
    Image|endswith: /mv
  selection_command_truncate:
    Image|endswith: /truncate
    CommandLine|contains|all:
      - "0 "
      - /var/log/syslog
    CommandLine|contains:
      - "-s "
      - "-c "
      - --size
  selection_command_ln:
    Image|endswith: /ln
    CommandLine|contains|all:
      - "/dev/null "
      - /var/log/syslog
    CommandLine|contains:
      - "-sf "
      - "-sfn "
      - "-sfT "
  selection_command_cp:
    Image|endswith: /cp
    CommandLine|contains: /dev/null
  selection_command_shred:
    Image|endswith: /shred
    CommandLine|contains: "-u "
  selection_unique_other:
    CommandLine|contains:
      - " > /var/log/syslog"
      - " >/var/log/syslog"
      - " >| /var/log/syslog"
      - ": > /var/log/syslog"
      - :> /var/log/syslog
      - :>/var/log/syslog
      - ">|/var/log/syslog"
  selection_unique_journalctl:
    CommandLine|contains:
      - journalctl --vacuum
      - journalctl --rotate
  condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
falsepositives:
  - Log rotation.
  - Maintenance.
level: high
license: DRL-1.1
related:
  - id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
    type: derived