Feat: extend syslog clearing rule - add variants & empty-file idioms

Overhauled the rule to remove so unnecessary additions, added journalctl --rotate

Author: vl43den

rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml

@@ -25,12 +25,6 @@ detection:
             - 'mv /var/log/syslog'
             - ' >/var/log/syslog'
             - ' > /var/log/syslog'
-            - '>/var/log/syslog'
-            - 'true > /var/log/syslog'
-            - 'echo "" > /var/log/syslog'
-            - 'echo -n > /var/log/syslog'
-            - "printf '' > /var/log/syslog"
-            - 'cat /dev/null > /var/log/syslog'
             - 'cp /dev/null /var/log/syslog'
             - 'ln -sf /dev/null /var/log/syslog'   # link command variants
             - 'ln -sfn /dev/null /var/log/syslog'
@@ -41,10 +35,12 @@ detection:
             - 'truncate --size=0 /var/log/syslog'
             - 'shred -u /var/log/syslog'
             - ' >| /var/log/syslog'  # redirection empties w spacing, noclobber
+            - '>|/var/log/syslog'
             - ':>/var/log/syslog'
             - ':> /var/log/syslog'
             - ': > /var/log/syslog'
             - 'journalctl --vacuum'
+            - 'journalctl --rotate' # archives current journal files and creates new empty ones
     condition: selection
 falsepositives:
     - Log rotation.