Linux Syslog Daemon Stopped or Killed
Detects an adversary stopping or killing the syslog daemon (syslog, rsyslog, or syslog-ng), which is responsible for forwarding system events to /var/log and to SIEM collectors. Stopping the syslog daemon is distinct from clearing existing logs -- it cuts the live telemetry pipeline at the source. Any activity occurring after the daemon is stopped produces no log records whatsoever, creating a blind spot.
Sigma
