Deletion of a Linux system log file recorded by auditd

1title: Deletion of a Linux system log file recorded by auditd2id: fba96e68-528a-49df-9b82-c26eb23998583status: experimental4description: |5  AN1438 asks for "anomalous deletions or truncations of system logs"6  correlated with the command that caused them. That correlation is out of7  reach — auditd splits one event across a SYSCALL record, carrying the exe,8  uid and command, and a PATH record, carrying the filename and how it was9  touched, and lib/sigma has no join across them — so this rule keeps only10  the file-side half, on the one PATH field that says what actually happened11  to the name: `nametype`. A value of `DELETE` means the path was unlinked,12  which is what `rm`, `shred -u` and a rotate-then-remove sequence all produce13  on the log file itself. It is deliberately not the whole of AN1438: `echo >14  /var/log/auth.log`, `truncate -s 0` and `cat /dev/null >` all clear a log's15  contents through `open(O_TRUNC)` without unlinking the path, so `nametype`16  stays `NORMAL` for every one of them and this selector is blind to the17  method MITRE's own citation (Linux Logs) implies is the more common one.18  The path list is the seven files and one directory the technique's own19  description names verbatim — /var/log/messages, /var/log/secure,20  /var/log/auth.log, /var/log/utmp, /var/log/wtmp, /var/log/kern.log,21  /var/log/cron.log, /var/log/maillog and /var/log/httpd/ — not MITRE's22  LogFilePathPattern knob restated, since the brief gives no regex, only this23  prose list. A second selector, `key: 'log_tamper'`, is this pipeline's own24  suggested audit-key convention, offered as a second path to the same event25  for a deployment whose watch tags truncating syscalls (`truncate`,26  `ftruncate`, `unlink`, `unlinkat`, `rename`, `renameat`) under that name27  instead of relying on `nametype` alone; MITRE supplies the knob's intent,28  the key string is this pipeline's, not MITRE's. UserContext (higher severity29  for root) cannot be applied inside a PATH selection: uid and auid live only30  on the SYSCALL record. AN1439, the macOS arm, is not attempted: its one31  logsource, {product: macos, service: unifiedlog}, has no standardised Sigma32  field vocabulary anywhere in this corpus, the same ground T1546.004 and33  T1027.011 already declined their macOS legs on — inventing field names for34  it would parse in four backends and match nothing.35  Prerequisite: auditd watches none of these paths by default. Both selectors36  need an explicit watch loaded first, for example `-w /var/log/auth.log -p37  wa -k log_tamper` repeated per path above (and per distribution equivalent —38  RHEL-family hosts use /var/log/secure where Debian-family hosts use39  /var/log/auth.log), and zero rows without it reads as quiet when it40  actually means blind.41  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0520, not hand-written and not tested by its author. Any lab result is on this rule's own page.42references:43  - https://attack.mitre.org/techniques/T1685/00644  - https://attack.mitre.org/detectionstrategies/DET052045author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)46date: 2026-08-1847tags:48  - attack.defense-evasion49  - attack.t1685.00650logsource:51  product: linux52  service: auditd53detection:54  selection_log_deleted:55    type: 'PATH'56    nametype: 'DELETE'57    name|contains:58      - '/var/log/messages'59      - '/var/log/secure'60      - '/var/log/auth.log'61      - '/var/log/utmp'62      - '/var/log/wtmp'63      - '/var/log/kern.log'64      - '/var/log/cron.log'65      - '/var/log/maillog'66      - '/var/log/httpd/'67  selection_watch_key:68    key: 'log_tamper'69  condition: 1 of selection*70falsepositives:71  - "logrotate's default nightly rotation of every path in this list — auth.log/secure, messages, maillog and cron.log all get renamed and recreated on essentially every mainstream distribution's stock logrotate.d config, which is exactly the unlink-and-recreate sequence the nametype=DELETE selector is built to catch, and is the loudest source here by a wide margin."72  - "Apache's own log rotation for /var/log/httpd/ — a piped rotatelogs or cronolog target recreates the access and error log on its own internal schedule independent of logrotate, on any moderately busy web server."73  - "Package installation, removal or reinstallation of a syslog implementation such as rsyslog or sysklogd, whose postinst and prerm maintainer scripts create or truncate these exact default log files as part of setup and teardown."74  - "An administrator's own disk-space remediation during an incident — manually clearing a runaway auth.log or maillog with a redirect or truncate — which is the same operator-driven event the key-based selector is meant to catch and is indistinguishable from the technique by this rule alone."75level: low