Suspicious Linux Logs Clearing Attempts (via process_creation)

title: Suspicious Linux Logs Clearing Attempts (via process_creation)
id: 25043e5e-73a9-5834-bef2-53c4deba2620
status: stable
description: This rule detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories. Adversaries frequently try to clear logs to cover their tracks after performing hostile activities.
references:
    - https://attack.mitre.org/techniques/T1685/006/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
author: Huntrule Team
date: 2026-03-03
tags:
    - attack.defense-impairment
    - attack.t1685.006
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '/rm'
            - '/rmdir'
            - '/shred'
            - '/unlink'
        CommandLine|contains:
            - '/var/log'
            - '/var/spool/mail'
    filter_main_legit_systat:
        Image|endswith: '/rm'
        CommandLine|startswith: 'rm -f /var/log/sysstat/'
    filter_main_dmseg:
        Image|endswith: '/rm'
        CommandLine|startswith: 'rm -f -- /var/log//dmesg'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium