Commands to Clear or Remove the Syslog - Builtin

Title: Commands to Clear or Remove the Syslog - Builtin
Status: test
Description:Detects specific commands commonly used to remove or empty the syslog
References:
  -https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
Author: Max Altgelt (Nextron Systems)
Date: 2021-09-10
modified:2022-11-26
Tags:

• -'attack.impact'
• -'attack.t1565.001'

Logsource:

• product: linux

Detection:
  selection:
    - 'rm /var/log/syslog'
    - 'rm -r /var/log/syslog'
    - 'rm -f /var/log/syslog'
    - 'rm -rf /var/log/syslog'
    - 'mv /var/log/syslog'
    - ' >/var/log/syslog'
    - ' > /var/log/syslog'
  falsepositives:
    - '/syslog.'
  condition:selection and not falsepositives
Falsepositives:
  -Log rotation
Level: high