{"id":"e09eb557-96d2-4de9-ba2d-30f712a5afd3","title":"Commands to Clear or Remove the Syslog - Builtin","description":"Detects specific commands commonly used to remove or empty the syslog","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-09-10","modified":"2022-11-26","tags":["attack.impact","attack.t1565.001"],"technique_ids":["T1565.001"],"logsource":{"product":"linux"},"falsepositives":["Log rotation"],"references":["https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474"],"source_path":"rules/linux/builtin/lnx_clear_syslog.yml","source_sha256":"9a4013f7037340a2112e055eacab73835174eaa0faa940bbb0fba681934f5e12","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_clear_syslog.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Commands to Clear or Remove the Syslog - Builtin\nid: e09eb557-96d2-4de9-ba2d-30f712a5afd3\nstatus: test\ndescription: Detects specific commands commonly used to remove or empty the syslog\nreferences:\n    - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474\nauthor: Max Altgelt (Nextron Systems)\ndate: 2021-09-10\nmodified: 2022-11-26\ntags:\n    - attack.impact\n    - attack.t1565.001\nlogsource:\n    product: linux\ndetection:\n    selection:\n        - 'rm /var/log/syslog'\n        - 'rm -r /var/log/syslog'\n        - 'rm -f /var/log/syslog'\n        - 'rm -rf /var/log/syslog'\n        - 'mv /var/log/syslog'\n        - ' >/var/log/syslog'\n        - ' > /var/log/syslog'\n    falsepositives:\n        - '/syslog.'\n    condition: selection and not falsepositives\nfalsepositives:\n    - Log rotation\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1565.001","id":"T1565.001","name":"Stored Data Manipulation","page":"techniques/enterprise/T1565.001/"}],"data_path":"data/detection-rules/e09eb557-96d2-4de9-ba2d-30f712a5afd3.json","kind":"sigma"}