Commands to Clear or Remove the Syslog

 1title: Commands to Clear or Remove the Syslog
 2id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
 3status: test
 4description: Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
 7author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
 8date: 2021-10-15
 9modified: 2022-09-15
10tags:
11    - attack.defense-evasion
12    - attack.t1070.002
13logsource:
14    product: linux
15    category: process_creation
16detection:
17    selection:
18        CommandLine|contains:
19            - 'rm /var/log/syslog'
20            - 'rm -r /var/log/syslog'
21            - 'rm -f /var/log/syslog'
22            - 'rm -rf /var/log/syslog'
23            - 'unlink /var/log/syslog'
24            - 'unlink -r /var/log/syslog'
25            - 'unlink -f /var/log/syslog'
26            - 'unlink -rf /var/log/syslog'
27            - 'mv /var/log/syslog'
28            - ' >/var/log/syslog'
29            - ' > /var/log/syslog'
30    condition: selection
31falsepositives:
32    - Log rotation.
33level: high