Syslog Clearing or Removal Via System Utilities

SigmaHQ Detections@sigmaHQ

•updated Oct 28, 2025•5•1•55

Detects specific commands commonly used to remove or empty the syslog, a technique often used by attackers to hide their tracks. This rule identifies the use of utilities like 'rm', 'unlink', 'mv', 'truncate', 'ln', 'cp', 'shred', and 'journalctl' when their command lines target '/var/log/syslog' or perform actions that would clear syslog content.