Detectionhightest
Commands to Clear or Remove the Syslog - Builtin
Detects specific commands commonly used to remove or empty the syslog
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Max Altgelt (Nextron Systems)Created Fri Sep 10Updated Sat Nov 26e09eb557-96d2-4de9-ba2d-30f712a5afd3linux
Log Source
Linux
ProductLinux← raw: linux
Detection Logic
Detection Logic2 selectors
detection:
selection:
- 'rm /var/log/syslog'
- 'rm -r /var/log/syslog'
- 'rm -f /var/log/syslog'
- 'rm -rf /var/log/syslog'
- 'mv /var/log/syslog'
- ' >/var/log/syslog'
- ' > /var/log/syslog'
falsepositives:
- '/syslog.'
condition: selection and not falsepositivesFalse Positives
Log rotation
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
e09eb557-96d2-4de9-ba2d-30f712a5afd3
Status
test
Level
high
Type
Detection
Created
Fri Sep 10
Modified
Sat Nov 26
Path
rules/linux/builtin/lnx_clear_syslog.yml
Raw Tags
attack.impactattack.t1565.001