Convert indexed Sigma rules into analyst-ready detections.

title: Syslog Clearing or Removal Via System Utilities
id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
status: test
description: |
    Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
    - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2025-10-15
tags:
    - attack.defense-evasion
    - attack.t1070.002
logsource:
    product: linux
    category: process_creation
detection:
    selection_file:
        CommandLine|contains: '/var/log/syslog'
    selection_command_rm:
        # Examples:
        #   rm -f /var/log/syslog
        Image|endswith: '/rm'
        CommandLine|contains:
            - ' -r '
            - ' -f '
            - ' -rf '
            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
    selection_command_unlink:
        # Examples:
        #   unlink /var/log/syslog
        Image|endswith: '/unlink'
    selection_command_mv:
        # Examples:
        #   mv /var/log/syslog
        Image|endswith: '/mv'
    selection_command_truncate:
        # Examples:
        #   truncate --size 0 /var/log/syslog
        Image|endswith: '/truncate'
        CommandLine|contains|all:
            - '0 '
            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
        CommandLine|contains:
            - '-s '
            - '-c '
            - '--size'
    selection_command_ln:
        # Examples:
        #   ln -sfn /dev/null /var/log/syslog
        Image|endswith: '/ln'
        CommandLine|contains|all:
            - '/dev/null '
            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
        CommandLine|contains:
            - '-sf '
            - '-sfn '
            - '-sfT '
    selection_command_cp:
        # Examples:
        #   cp /dev/null /var/log/syslog
        Image|endswith: '/cp'
        CommandLine|contains: '/dev/null'
    selection_command_shred:
        # Examples:
        #   shred -u /var/log/syslog
        Image|endswith: '/shred'
        CommandLine|contains: '-u '
    selection_unique_other:
        CommandLine|contains:
            - ' > /var/log/syslog'
            - ' >/var/log/syslog'
            - ' >| /var/log/syslog'  # redirection empties w spacing, noclobber
            - ': > /var/log/syslog'
            - ':> /var/log/syslog'
            - ':>/var/log/syslog'
            - '>|/var/log/syslog'
    selection_unique_journalctl:
        CommandLine|contains:
            - 'journalctl --vacuum'
            - 'journalctl --rotate' # archives current journal files and creates new empty ones
    condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
falsepositives:
    - Log rotation.
    - Maintenance.
level: high