Detection of Unauthorized Linux System Log Deletion

Adversaries often target system log files on Linux systems to obfuscate their activities, destroy forensic trails, and evade detection by security operations teams. This behavior is a common component of post-exploitation activity where attackers attempt to hide indicators of compromise after gaining initial access or escalating privileges. The threat involves the removal of standard system files such as authentication records, boot logs, and kernel logs located in /var/log/ or /var/run/.

Monitoring for these deletions is essential for maintaining visibility into system integrity. However, defenders must account for legitimate system operations, such as log rotation, compression, and container management, which may legitimately interact with these files. Distinguishing malicious deletion from maintenance tasks is critical for effective alerting and preventing alert fatigue.

Impact

Successful deletion of system logs prevents incident responders from reconstructing attacker activity, identifying the scope of a breach, or determining the duration of unauthorized access. This loss of forensic evidence can significantly increase the duration and cost of an incident response engagement.

Recommendation

• Deploy the provided Sigma rule to monitor for deletion of sensitive log files in /var/log/ and /var/run/.
• Tune the detection logic by adding paths or process names associated with local backup tools, custom scripts, or specific log rotation utilities verified in your environment.
• Implement file integrity monitoring (FIM) or robust centralized logging to capture deletion events before the logs themselves are purged from the local host.
• Establish an automated response workflow to isolate systems where unauthorized log deletion is detected to prevent further data tampering.