Update lnx_clear_logs.yml

2020-10-16 10:32:25 +03:00
parent 18821d2255
commit 46e887ef38
1 changed files with 3 additions and 0 deletions
@@ -8,6 +8,7 @@ references:
    - https://attack.mitre.org/techniques/T1070/002/
 logsource:
    product: linux
+    category: process_creation
 detection:
    keywords:
        - Commands|contains:
@@ -15,6 +16,8 @@ detection:
          - 'shred -u /var/log*'
          - 'echo * > /var/log*'
          - 'rmdir * /var/log*'
+          - 'rm * /private/var/audit/*'
+          - 'rm * /private/var/log/system.log*'
    condition: keywords
 falsepositives:
    - Legitimate administration activities