Query: rule covering Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a
Matching passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a. Logsource: linux / process_creation. Rule: title: Syslog Clearing or Removal Via System Utilities id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31 status: test description: 'Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2025-10-15 tags: - attack.defense-impairment - attack.t1685.006 logsource: product: linux category: process_creation detection: selection_file: CommandLine|contains: /var/log/syslog selection_command_rm: Image|endswith: /rm CommandLine|contains: - ' -r ' - ' -f ' - ' -rf ' - /var/log/syslog selection_command_unlink: Image|endswith: /unlink selection_command_mv: Image|endswith: /mv selection_command_truncate: Image|endswith: /truncate CommandLine|contains|all: - '0 ' - /var/log/syslog CommandLine|contains: - '-s ' - '-c ' - --size selection_command_ln: Image|endswith: /ln CommandLine|contains|all: - '/dev/null ' - /var/log/syslog CommandLine|contains: - '-sf ' - '-sfn ' - '-sfT ' selection_command_cp: Image|endswith: /cp CommandLine|contains: /dev/null selection_command_shred: Image|endswith: /shred CommandLine|contains: '-u ' selection_unique_other: CommandLine|contains: - ' > /var/log/syslog' - ' >/var/log/syslog' - ' >| /var/log/syslog' - ': > /var/log/syslog' - :> /var/log/syslog - :>/var/log/syslog - '>|/var/log/syslog' selection_unique_journalctl: CommandLine|contains: - journalctl --vacuum - journalctl --rotate condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_* falsepositives: - Log rotation. - Maintenance. level: high
Near-miss passage: Sigma rule: Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indic. Logsource: windows / image_load. Rule: title: MMC Loading Script Engines DLLs id: a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad status: experimental description: 'Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion. ' references: - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.elastic.co/security-labs/grimresource author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218.014 logsource: category: image_load product: windows detection: selection: Image|endswith: \mmc.exe ImageLoaded|endswith: - \vbscript.dll - \jscript.dll - \jscript9.dll condition: selection falsepositives: - Legitimate MMC operations or extensions loading these libraries level: medium