Roberto Rodriguez
28 lines
854 B
YAML
28 lines
854 B
YAML
title: Commands to Clear or Remove the Syslog
|
|
id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
|
|
status: experimental
|
|
description: Detects specific commands commonly used to remove or empty the syslog.
|
|
date: 2021/10/15
|
|
author: Max Altgelt, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
|
|
tags:
|
|
- attack.impact
|
|
- attack.t1565.001
|
|
references:
|
|
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/lnx_clear_syslog.yml
|
|
logsource:
|
|
product: linux
|
|
category: process_creation
|
|
detection:
|
|
selection:
|
|
CommandLine|contains:
|
|
- 'rm /var/log/syslog'
|
|
- 'rm -r /var/log/syslog'
|
|
- 'rm -f /var/log/syslog'
|
|
- 'rm -rf /var/log/syslog'
|
|
- 'mv /var/log/syslog'
|
|
- ' >/var/log/syslog'
|
|
- ' > /var/log/syslog'
|
|
condition: selection
|
|
falsepositives:
|
|
- Log rotation.
|
|
level: high |