{"id":"3fcc9b35-39e4-44c0-a2ad-9e82b6902b31","title":"Syslog Clearing or Removal Via System Utilities","description":"Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks\n","author":"Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2025-10-15","tags":["attack.defense-impairment","attack.t1685.006"],"technique_ids":["T1685.006"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Log rotation.","Maintenance."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md","https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior"],"source_path":"rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml","source_sha256":"e291c68ed6fc6fb1d6629e5ed48849c935c92acca53c9e51980cda1756e6ccff","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Syslog Clearing or Removal Via System Utilities\nid: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31\nstatus: test\ndescription: |\n    Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\n    - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior\nauthor: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2025-10-15\ntags:\n    - attack.defense-impairment\n    - attack.t1685.006\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_file:\n        CommandLine|contains: '/var/log/syslog'\n    selection_command_rm:\n        # Examples:\n        #   rm -f /var/log/syslog\n        Image|endswith: '/rm'\n        CommandLine|contains:\n            - ' -r '\n            - ' -f '\n            - ' -rf '\n            - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n    selection_command_unlink:\n        # Examples:\n        #   unlink /var/log/syslog\n        Image|endswith: '/unlink'\n    selection_command_mv:\n        # Examples:\n        #   mv /var/log/syslog\n        Image|endswith: '/mv'\n    selection_command_truncate:\n        # Examples:\n        #   truncate --size 0 /var/log/syslog\n        Image|endswith: '/truncate'\n        CommandLine|contains|all:\n            - '0 '\n            - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n        CommandLine|contains:\n            - '-s '\n            - '-c '\n            - '--size'\n    selection_command_ln:\n        # Examples:\n        #   ln -sfn /dev/null /var/log/syslog\n        Image|endswith: '/ln'\n        CommandLine|contains|all:\n            - '/dev/null '\n            - '/var/log/syslog' # We use this to avoid re-writing a separate selection\n        CommandLine|contains:\n            - '-sf '\n            - '-sfn '\n            - '-sfT '\n    selection_command_cp:\n        # Examples:\n        #   cp /dev/null /var/log/syslog\n        Image|endswith: '/cp'\n        CommandLine|contains: '/dev/null'\n    selection_command_shred:\n        # Examples:\n        #   shred -u /var/log/syslog\n        Image|endswith: '/shred'\n        CommandLine|contains: '-u '\n    selection_unique_other:\n        CommandLine|contains:\n            - ' > /var/log/syslog'\n            - ' >/var/log/syslog'\n            - ' >| /var/log/syslog'  # redirection empties w spacing, noclobber\n            - ': > /var/log/syslog'\n            - ':> /var/log/syslog'\n            - ':>/var/log/syslog'\n            - '>|/var/log/syslog'\n    selection_unique_journalctl:\n        CommandLine|contains:\n            - 'journalctl --vacuum'\n            - 'journalctl --rotate' # archives current journal files and creates new empty ones\n    condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*\nfalsepositives:\n    - Log rotation.\n    - Maintenance.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","page":"techniques/enterprise/T1685.006/"}],"data_path":"data/detection-rules/3fcc9b35-39e4-44c0-a2ad-9e82b6902b31.json","kind":"sigma"}