Linux Commands Clearing or Removing /var/log/syslog

title: Linux Commands Clearing or Removing /var/log/syslog
id: 6343c484-f7cc-45a2-bed5-a65afa2f4a2b
status: test
description: This rule matches common shell commands that delete, recursively remove, forcibly delete, or move /var/log/syslog, as well as shell redirection patterns that empty the file. Attackers may use these actions to cover tracks and disrupt forensic investigation by destroying syslog records. It relies on Linux command/argument telemetry that records executed commands containing /var/log/syslog, and it excludes matches containing '/syslog.' to reduce false positives.
references:
  - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_clear_syslog.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-09-10
modified: 2022-11-26
tags:
  - attack.impact
  - attack.t1565.001
logsource:
  product: linux
detection:
  selection:
    - rm /var/log/syslog
    - rm -r /var/log/syslog
    - rm -f /var/log/syslog
    - rm -rf /var/log/syslog
    - mv /var/log/syslog
    - " >/var/log/syslog"
    - " > /var/log/syslog"
  falsepositives:
    - /syslog.
  condition: selection and not falsepositives
falsepositives:
  - Log rotation
level: high
license: DRL-1.1
related:
  - id: e09eb557-96d2-4de9-ba2d-30f712a5afd3
    type: derived