Query: Sigma rule for Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a
Matching passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a. Logsource: linux / process_creation. Rule: title: Syslog Clearing or Removal Via System Utilities id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31 status: test description: 'Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2025-10-15 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection_file: CommandLine|contains: /var/log/syslog selection_command_rm: Image|endswith: /rm CommandLine|contains: - ' -r ' - ' -f ' - ' -rf ' - /var/log/syslog selection_command_unlink: Image|endswith: /unlink selection_command_mv: Image|endswith: /mv selection_command_truncate: Image|endswith: /truncate CommandLine|contains|all: - '0 ' - /var/log/syslog CommandLine|contains: - '-s ' - '-c ' - --size selection_command_ln: Image|endswith: /ln CommandLine|contains|all: - '/dev/null ' - /var/log/syslog CommandLine|contains: - '-sf ' - '-sfn ' - '-sfT ' selection_command_cp: Image|endswith: /cp CommandLine|contains: /dev/null selection_command_shred: Image|endswith: /shred CommandLine|contains: '-u ' selection_unique_other: CommandLine|contains: - ' > /var/log/syslog' - ' >/var/log/syslog' - ' >| /var/log/syslog' - ': > /var/log/syslog' - :> /var/log/syslog - :>/var/log/syslog - '>|/var/log/syslog' selection_unique_journalctl: CommandLine|contains: - journalctl --vacuum - journalctl --rotate condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_* falsepositives: - Log rotation. - Maintenance. level: high
Near-miss passage: Sigma rule: Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect. Logsource: windows / process_creation. Rule: title: Virtualbox Driver Installation or Starting of VMs id: bab049ca-7471-4828-9024-38279a4c04da status: test description: Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM. references: - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/ - https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/ author: Janantha Marasinghe date: 2020-09-26 modified: 2025-07-29 tags: - attack.stealth - attack.t1564.006 - attack.t1564 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - VBoxRT.dll,RTR3Init - VBoxC.dll - VBoxDrv.sys selection_2: CommandLine|contains: - startvm - controlvm condition: 1 of selection_* falsepositives: - This may have false positives on hosts where Virtualbox is legitimately being used for operations level: low