Linux Syslog Clearing or Removal Commands
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
Sigma
