{"id":"eca5e022-d368-4043-98e5-9736fb01f72f","title":"Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall","description":"Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),\n(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel\nring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation\nor privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.\n","author":"Milad Cheraghi","status":"experimental","level":"medium","date":"2025-05-27","modified":"2025-12-05","tags":["attack.defense-impairment","attack.t1685.006"],"technique_ids":["T1685.006"],"logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs\n-a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs\n-a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs\n-a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs\n"},"falsepositives":["System administrators or scripts that intentionally clear logs","Debugging scripts"],"references":["https://man7.org/linux/man-pages/man2/syslog.2.html","https://man7.org/linux/man-pages/man1/dmesg.1.html"],"source_path":"rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml","source_sha256":"4e01f4c621ab197a7005d223de57ee6431c6099449bbd4c6614c1df1e60795e8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall\nid: eca5e022-d368-4043-98e5-9736fb01f72f\nstatus: experimental\ndescription: |\n    Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),\n    (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel\n    ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation\n    or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.\nreferences:\n    - https://man7.org/linux/man-pages/man2/syslog.2.html\n    - https://man7.org/linux/man-pages/man1/dmesg.1.html\nauthor: Milad Cheraghi\ndate: 2025-05-27\nmodified: 2025-12-05\ntags:\n    - attack.defense-impairment\n    - attack.t1685.006\nlogsource:\n    product: linux\n    service: auditd\n    definition: |\n        Required auditd configuration:\n        -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs\n        -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs\n        -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs\n        -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs\n        -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs\n        -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs\ndetection:\n    selection:\n        type: 'SYSCALL'\n        SYSCALL: 'syslog'\n        a0:\n            - 4 # SYSLOG_ACTION_READ_CLEAR : Read and clear log\n            - 5 # SYSLOG_ACTION_CLEAR: Clear kernel ring buffer (without reading)\n            - 6 # SYSLOG_ACTION_CONSOLE_OFF: Disable logging to console\n    condition: selection\nfalsepositives:\n    - System administrators or scripts that intentionally clear logs\n    - Debugging scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","page":"techniques/enterprise/T1685.006/"}],"data_path":"data/detection-rules/eca5e022-d368-4043-98e5-9736fb01f72f.json","kind":"sigma"}