Linux Syslog Clearing or Removal Using System Utilities
Alert on Linux commands that clear, delete, truncate, or redirect /var/log/syslog or rotate/vacuum journald logs.
- Product
- linux
- Category
- process_creation
- Author
- Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC (SigmaHQ), DRL 1.1
- Published
- 2021-10-15
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions that target /var/log/syslog for deletion, unlinking, truncation to zero length, replacement, or redirection to empty content. Attackers may use these actions to impair or erase evidence in system logging and hinder incident investigation. It relies on Linux process creation telemetry, matching command-line arguments and utility names that operate on /var/log/syslog or invoke journalctl vacuum/rotation.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
- virustotal.comhttps://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Syslog Clearing or Removal Using System Utilities
id: ede22a96-2bb0-4814-91cd-f3dafe290a3d
status: test
description: This rule flags Linux process executions that target /var/log/syslog for deletion, unlinking, truncation to zero length, replacement, or redirection to empty content. Attackers may use these actions to impair or erase evidence in system logging and hinder incident investigation. It relies on Linux process creation telemetry, matching command-line arguments and utility names that operate on /var/log/syslog or invoke journalctl vacuum/rotation.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
- https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml
author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2025-10-15
tags:
- attack.defense-impairment
- attack.t1685.006
logsource:
product: linux
category: process_creation
detection:
selection_file:
CommandLine|contains: /var/log/syslog
selection_command_rm:
Image|endswith: /rm
CommandLine|contains:
- " -r "
- " -f "
- " -rf "
- /var/log/syslog
selection_command_unlink:
Image|endswith: /unlink
selection_command_mv:
Image|endswith: /mv
selection_command_truncate:
Image|endswith: /truncate
CommandLine|contains|all:
- "0 "
- /var/log/syslog
CommandLine|contains:
- "-s "
- "-c "
- --size
selection_command_ln:
Image|endswith: /ln
CommandLine|contains|all:
- "/dev/null "
- /var/log/syslog
CommandLine|contains:
- "-sf "
- "-sfn "
- "-sfT "
selection_command_cp:
Image|endswith: /cp
CommandLine|contains: /dev/null
selection_command_shred:
Image|endswith: /shred
CommandLine|contains: "-u "
selection_unique_other:
CommandLine|contains:
- " > /var/log/syslog"
- " >/var/log/syslog"
- " >| /var/log/syslog"
- ": > /var/log/syslog"
- :> /var/log/syslog
- :>/var/log/syslog
- ">|/var/log/syslog"
selection_unique_journalctl:
CommandLine|contains:
- journalctl --vacuum
- journalctl --rotate
condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
falsepositives:
- Log rotation.
- Maintenance.
level: high
license: DRL-1.1
related:
- id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
type: derived