Detectionmediumexperimental

Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall

Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Milad CheraghiCreated Tue May 27Updated Fri Dec 05eca5e022-d368-4043-98e5-9736fb01f72flinux

Log Source

Linuxauditd

ProductLinux← raw: linux

Serviceauditd← raw: auditd

Definition

Required auditd configuration: -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs

Detection Logic

detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'syslog'
        a0:
            - 4 # SYSLOG_ACTION_READ_CLEAR : Read and clear log
            - 5 # SYSLOG_ACTION_CLEAR: Clear kernel ring buffer (without reading)
            - 6 # SYSLOG_ACTION_CONSOLE_OFF: Disable logging to console
    condition: selection