Nasreddine Bencherchali
88 lines
3.1 KiB
YAML
88 lines
3.1 KiB
YAML
title: Syslog Clearing or Removal Via System Utilities
|
|
id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
|
|
status: test
|
|
description: |
|
|
Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
|
|
- https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
|
|
author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
|
|
date: 2021-10-15
|
|
modified: 2025-10-15
|
|
tags:
|
|
- attack.defense-impairment
|
|
- attack.t1685.006
|
|
logsource:
|
|
product: linux
|
|
category: process_creation
|
|
detection:
|
|
selection_file:
|
|
CommandLine|contains: '/var/log/syslog'
|
|
selection_command_rm:
|
|
# Examples:
|
|
# rm -f /var/log/syslog
|
|
Image|endswith: '/rm'
|
|
CommandLine|contains:
|
|
- ' -r '
|
|
- ' -f '
|
|
- ' -rf '
|
|
- '/var/log/syslog' # We use this to avoid re-writing a separate selection
|
|
selection_command_unlink:
|
|
# Examples:
|
|
# unlink /var/log/syslog
|
|
Image|endswith: '/unlink'
|
|
selection_command_mv:
|
|
# Examples:
|
|
# mv /var/log/syslog
|
|
Image|endswith: '/mv'
|
|
selection_command_truncate:
|
|
# Examples:
|
|
# truncate --size 0 /var/log/syslog
|
|
Image|endswith: '/truncate'
|
|
CommandLine|contains|all:
|
|
- '0 '
|
|
- '/var/log/syslog' # We use this to avoid re-writing a separate selection
|
|
CommandLine|contains:
|
|
- '-s '
|
|
- '-c '
|
|
- '--size'
|
|
selection_command_ln:
|
|
# Examples:
|
|
# ln -sfn /dev/null /var/log/syslog
|
|
Image|endswith: '/ln'
|
|
CommandLine|contains|all:
|
|
- '/dev/null '
|
|
- '/var/log/syslog' # We use this to avoid re-writing a separate selection
|
|
CommandLine|contains:
|
|
- '-sf '
|
|
- '-sfn '
|
|
- '-sfT '
|
|
selection_command_cp:
|
|
# Examples:
|
|
# cp /dev/null /var/log/syslog
|
|
Image|endswith: '/cp'
|
|
CommandLine|contains: '/dev/null'
|
|
selection_command_shred:
|
|
# Examples:
|
|
# shred -u /var/log/syslog
|
|
Image|endswith: '/shred'
|
|
CommandLine|contains: '-u '
|
|
selection_unique_other:
|
|
CommandLine|contains:
|
|
- ' > /var/log/syslog'
|
|
- ' >/var/log/syslog'
|
|
- ' >| /var/log/syslog' # redirection empties w spacing, noclobber
|
|
- ': > /var/log/syslog'
|
|
- ':> /var/log/syslog'
|
|
- ':>/var/log/syslog'
|
|
- '>|/var/log/syslog'
|
|
selection_unique_journalctl:
|
|
CommandLine|contains:
|
|
- 'journalctl --vacuum'
|
|
- 'journalctl --rotate' # archives current journal files and creates new empty ones
|
|
condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
|
|
falsepositives:
|
|
- Log rotation.
|
|
- Maintenance.
|
|
level: high
|