Clear Log Activities

Description

Detect clearing of critical access log files, typically done to erase evidence that could be attributed to an adversary's actions. To effectively customize and operationalize this detection, check for potentially missing log file destinations relevant to your environment, and adjust the profiled containers you wish not to be alerted on.

Query · falco

open_write and access_log_files and evt.arg.flags contains "O_TRUNC" and not containerd_activities and not trusted_logging_images and not allowed_clear_log_files

Rule dependencies

Depends on

  • composes · Falco macro access_log_files
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro allowed_clear_log_files
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro containerd_activities
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro trusted_logging_images
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Log files were tampered | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Clear Log Activities · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Clear Log Activities
desc: 'Detect clearing of critical access log files, typically done to erase evidence
  that could be attributed to an adversary''s actions. To effectively customize and
  operationalize this detection, check for potentially missing log file destinations
  relevant to your environment, and adjust the profiled containers you wish not to
  be alerted on.

  '
condition: 'open_write and access_log_files and evt.arg.flags contains "O_TRUNC" and
  not containerd_activities and not trusted_logging_images and not allowed_clear_log_files

  '
output: Log files were tampered | file=%fd.name evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- filesystem
- mitre_defense_evasion
- T1070
- NIST_800-53_AU-10

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.