Query: Sigma rule for Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 i
Matching passage: Sigma rule: Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 i. Logsource: linux / auditd. Rule: title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall id: eca5e022-d368-4043-98e5-9736fb01f72f status: experimental description: 'Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally. ' references: - https://man7.org/linux/man-pages/man2/syslog.2.html - https://man7.org/linux/man-pages/man1/dmesg.1.html author: Milad Cheraghi date: 2025-05-27 modified: 2025-12-05 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs ' detection: selection: type: SYSCALL SYSCALL: syslog a0: - 4 - 5 - 6 condition: selection falsepositives: - System administrators or scripts that intentionally clear logs - Debugging scripts level: medium
Near-miss passage: Sigma rule: Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persist. Logsource: windows / registry_set. Rule: title: Modify User Shell Folders Startup Value id: 9c226817-8dc9-46c2-a58d-66655aafd7dc related: - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818 type: similar status: test description: 'Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-10-01 modified: 2026-01-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.001 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders TargetObject|endswith: - \Common Startup - \Startup filter_main_details_null: Details: null filter_main_programdata_startup: Details|contains: - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup - '%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup' filter_main_userprofile_startup_1: Details|contains: - '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' - '%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' filter_main_userprofile_startup_2: Details|contains|all: - C:\Users\ - \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml simulation: - type: atomic-red-team name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value technique: T1547.001 atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b