{"id":"80915f59-9b56-4616-9de0-fd0dea6c12fe","title":"Linux Logs Clearing Attempts","description":"Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.\nAdversaries often try to clear logs to cover their tracks after performing malicious activities.\n","author":"Ömer Günal, oscd.community","status":"stable","level":"medium","date":"2020-10-07","modified":"2026-03-18","tags":["attack.defense-impairment","attack.t1685.006"],"technique_ids":["T1685.006"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md"],"source_path":"rules/linux/process_creation/proc_creation_lnx_clear_logs.yml","source_sha256":"5fedfdba71903106f04430659418e9dfabb58a4781e39217328e9bd6a6d0a8a2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Logs Clearing Attempts\nid: 80915f59-9b56-4616-9de0-fd0dea6c12fe\nstatus: stable\ndescription: |\n    Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.\n    Adversaries often try to clear logs to cover their tracks after performing malicious activities.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md\nauthor: Ömer Günal, oscd.community\ndate: 2020-10-07\nmodified: 2026-03-18\ntags:\n    - attack.defense-impairment\n    - attack.t1685.006\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith:\n            - '/rm'    # covers /rmdir as well\n            - '/rmdir'\n            - '/shred'\n            - '/unlink'\n        CommandLine|contains:\n            - '/var/log'\n            - '/var/spool/mail'\n    filter_main_legit_systat:\n        Image|endswith: '/rm'\n        CommandLine|startswith: 'rm -f /var/log/sysstat/'\n    filter_main_dmseg:\n        Image|endswith: '/rm'\n        CommandLine|startswith: 'rm -f -- /var/log//dmesg' # // before dmesg is not typo\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","page":"techniques/enterprise/T1685.006/"}],"data_path":"data/detection-rules/80915f59-9b56-4616-9de0-fd0dea6c12fe.json","kind":"sigma"}