Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall (eca5e022-d368-4043-98e5-9736fb01f72f)
Detects the use of the syslog syscall with action code 5 (SYSLOG_ACTION_CLEAR),
(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
or privilege escalation. A common technique is running dmesg -c, which triggers this syscall internally.