Sigma rule: Linux Logs Clearing Attempts

Rule

Title

Linux Logs Clearing Attempts

Status

stable

Level

medium

Author

Ömer Günal, oscd.community

Date

2020-10-07

Modified

2026-03-18

File

rules/linux/process_creation/proc_creation_lnx_clear_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.

Log source

product

linux

category

process_creation

Detection

selection:
    Image|endswith:
        - '/rm'    # covers /rmdir as well
        - '/rmdir'
        - '/shred'
        - '/unlink'
    CommandLine|contains:
        - '/var/log'
        - '/var/spool/mail'
filter_main_legit_systat:
    Image|endswith: '/rm'
    CommandLine|startswith: 'rm -f /var/log/sysstat/'
filter_main_dmseg:
    Image|endswith: '/rm'
    CommandLine|startswith: 'rm -f -- /var/log//dmesg' # // before dmesg is not typo
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.defense-impairment
• attack.t1685.006

MITRE ATT&CK ids this rule names

• T1685.006

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_clear_logs.yml