Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall

SigmaHQ Detections@sigmaHQ

•updated Jun 5, 2025•2•0•33

Detects the use of the `syslog` syscall with action codes 4, 5, or 6, which can clear or disable the kernel ring buffer (dmesg logs). This technique can be used by attackers to hide traces after exploitation or privilege escalation. A common method is running `dmesg -c`, which internally triggers this syscall.