Sigma rule: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-1000e9308133, updated 2025-12-05T00:00:00.000Z.

Rule

Title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
Status: experimental
Level: medium
Author: Milad Cheraghi
Date: 2025-05-27
Modified: 2025-12-05
File: rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),
(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.

Log source

product: linux
service: auditd
definition: Required auditd configuration: -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs

Detection

selection:
    type: 'SYSCALL'
    SYSCALL: 'syslog'
    a0:
        - 4 # SYSLOG_ACTION_READ_CLEAR : Read and clear log
        - 5 # SYSLOG_ACTION_CLEAR: Clear kernel ring buffer (without reading)
        - 6 # SYSLOG_ACTION_CONSOLE_OFF: Disable logging to console
condition: selection

False positives (as the rule lists them)

System administrators or scripts that intentionally clear logs
Debugging scripts

MITRE ATT&CK ids this rule names

T1685.006

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml

Sources and licences

SigmaHQ
"Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall" by Milad Cheraghi (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall",
entity page, dataset version ref-1000e9308133, updated 2025-12-05T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/eca5e022-d368-4043-98e5-9736fb01f72f (accessed 2026-11-03).
Underlying source: SigmaHQ rule eca5e022-d368-4043-98e5-9736fb01f72f, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.