Linux Logs Clearing Attempts

Title: Linux Logs Clearing Attempts
Status: stable
Description:Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories. Adversaries often try to clear logs to cover their tracks after performing malicious activities.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
Author: Ömer Günal, oscd.community
Date: 2020-10-07
modified:2026-03-18
Tags:

• -'attack.defense-impairment'
• -'attack.t1685.006'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith:
      -'/rm'
      -'/rmdir'
      -'/shred'
      -'/unlink'

    CommandLine|contains:
      -'/var/log'
      -'/var/spool/mail'

  filter_main_legit_systat:
    Image|endswith: '/rm'
    CommandLine|startswith: 'rm -f /var/log/sysstat/'
  filter_main_dmseg:
    Image|endswith: '/rm'
    CommandLine|startswith: 'rm -f -- /var/log//dmesg'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate administration activities
Level: medium