IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Kernel Module Removal Enumeration of Kernel Modules »

› ›

System Log File Deletion

edit

System Log File Deletion

edit

Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.

Rule type: eql

Rule indices:

auditbeat-*
logs-endpoint.events.*
endgame-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html

Tags:

Elastic
Host
Linux
Threat Detection
Defense Evasion
Elastic Endgame

Version: 103

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Rule query

edit

file where event.type == "deletion" and
  file.path :
    (
    "/var/run/utmp",
    "/var/log/wtmp",
    "/var/log/btmp",
    "/var/log/lastlog",
    "/var/log/faillog",
    "/var/log/syslog",
    "/var/log/messages",
    "/var/log/secure",
    "/var/log/auth.log",
    "/var/log/boot.log",
    "/var/log/kern.log"
    ) and
    not process.name : ("gzip")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Indicator Removal
- ID: T1070
- Reference URL: https://attack.mitre.org/techniques/T1070/
Sub-technique:
- Name: Clear Linux or Mac System Logs
- ID: T1070.002
- Reference URL: https://attack.mitre.org/techniques/T1070/002/

« Kernel Module Removal Enumeration of Kernel Modules »