Query: write Sigma for Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a
Matching passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a. Logsource: linux / process_creation. Rule: title: Syslog Clearing or Removal Via System Utilities id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31 status: test description: 'Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2025-10-15 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection_file: CommandLine|contains: /var/log/syslog selection_command_rm: Image|endswith: /rm CommandLine|contains: - ' -r ' - ' -f ' - ' -rf ' - /var/log/syslog selection_command_unlink: Image|endswith: /unlink selection_command_mv: Image|endswith: /mv selection_command_truncate: Image|endswith: /truncate CommandLine|contains|all: - '0 ' - /var/log/syslog CommandLine|contains: - '-s ' - '-c ' - --size selection_command_ln: Image|endswith: /ln CommandLine|contains|all: - '/dev/null ' - /var/log/syslog CommandLine|contains: - '-sf ' - '-sfn ' - '-sfT ' selection_command_cp: Image|endswith: /cp CommandLine|contains: /dev/null selection_command_shred: Image|endswith: /shred CommandLine|contains: '-u ' selection_unique_other: CommandLine|contains: - ' > /var/log/syslog' - ' >/var/log/syslog' - ' >| /var/log/syslog' - ': > /var/log/syslog' - :> /var/log/syslog - :>/var/log/syslog - '>|/var/log/syslog' selection_unique_journalctl: CommandLine|contains: - journalctl --vacuum - journalctl --rotate condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_* falsepositives: - Log rotation. - Maintenance. level: high
Near-miss passage: Sigma rule: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Image/Driver Load For Policy Violation id: e4be5675-4a53-426a-8c81-a8bb2387e947 status: test description: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy. references: - https://twitter.com/wdormann/status/1590434950335320065 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2023-06-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3077 condition: selection falsepositives: - Unknown level: high