Query: detection rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a
Matching passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a. Logsource: linux / process_creation. Rule: title: Syslog Clearing or Removal Via System Utilities id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31 status: test description: 'Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2025-10-15 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection_file: CommandLine|contains: /var/log/syslog selection_command_rm: Image|endswith: /rm CommandLine|contains: - ' -r ' - ' -f ' - ' -rf ' - /var/log/syslog selection_command_unlink: Image|endswith: /unlink selection_command_mv: Image|endswith: /mv selection_command_truncate: Image|endswith: /truncate CommandLine|contains|all: - '0 ' - /var/log/syslog CommandLine|contains: - '-s ' - '-c ' - --size selection_command_ln: Image|endswith: /ln CommandLine|contains|all: - '/dev/null ' - /var/log/syslog CommandLine|contains: - '-sf ' - '-sfn ' - '-sfT ' selection_command_cp: Image|endswith: /cp CommandLine|contains: /dev/null selection_command_shred: Image|endswith: /shred CommandLine|contains: '-u ' selection_unique_other: CommandLine|contains: - ' > /var/log/syslog' - ' >/var/log/syslog' - ' >| /var/log/syslog' - ': > /var/log/syslog' - :> /var/log/syslog - :>/var/log/syslog - '>|/var/log/syslog' selection_unique_journalctl: CommandLine|contains: - journalctl --vacuum - journalctl --rotate condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_* falsepositives: - Log rotation. - Maintenance. level: high
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso. Logsource: m365 / threat_detection. Rule: title: Activity from Suspicious IP Addresses id: a3501e8e-af9e-43c6-8cd6-9360bdaae498 status: test description: 'Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account. ' references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1573 logsource: service: threat_detection product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Activity from suspicious IP addresses status: success condition: selection falsepositives: - Unknown level: medium