Loadable Kernel Module Load Followed by Log Clearing

[rule]
description = """
This rule detects when a loadable kernel module (LKM) is loaded, followed shortly by an attempt to clear system logs
using common log-clearing commands like "dmesg" or "journalctl". Rootkits often use LKMs to hide their presence, and
clearing logs right after loading is a common tactic to evade detection after such activities.
"""
id = "7ed2911b-839a-45a5-8215-8b17066b7dd8"
license = "Elastic License v2"
name = "Loadable Kernel Module Load Followed by Log Clearing"
os_list = ["linux"]
reference = [
    "https://www.elastic.co/security-labs/continuation-on-persistence-mechanisms",
    "https://github.com/MatheuZSecurity/Singularity",
]
version = "1.0.8"

query = '''
sequence with maxspan=10s
  [process where event.type == "start" and event.action == "load_module" and process.parent.executable != null]
  [process where event.type == "start" and event.action == "exec" and (
    (process.name == "dmesg" and process.args in ("-c", "-C", "--clear", "--read-clear")) or
    (process.name == "journalctl" and process.args like~ ("--vacuum-time=*", "--vacuum-size=*", "--vacuum-files=*"))
  )]
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"


[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"