Refine syslog clearing detection rules

Updated the title and description for clarity. Added new command selections for syslog clearing techniques and refined existing selections.

Author: nasbench

rules/linux/process_creation/proc_creation_lnx_clear_syslog.yml

@@ -1,47 +1,87 @@
-title: Commands to Clear or Remove the Syslog
+title: Syslog Clearing or Removal Via System Utilities
 id: 3fcc9b35-39e4-44c0-a2ad-9e82b6902b31
 status: test
-description: Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks
+description: |
+    Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
     - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
 author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
 date: 2021-10-15
-modified: 2025-08-18
+modified: 2025-10-15
 tags:
     - attack.defense-evasion
     - attack.t1070.002
 logsource:
     product: linux
     category: process_creation
 detection:
-    selection:
+    selection_file:
+        CommandLine|contains: '/var/log/syslog'
+    selection_command_rm:
+        # Examples:
+        #   rm -f /var/log/syslog
+        Image|endswith:
+            - '/rm'
+        CommandLine|contains:
+            - ' -r '
+            - ' -f '
+            - ' -rf '
+            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
+    selection_command_unlink:
+        # Examples:
+        #   unlink /var/log/syslog
+        Image|endswith: '/unlink'
+    selection_command_mv:
+        # Examples:
+        #   mv /var/log/syslog
+        Image|endswith: '/mv'
+    selection_command_truncate:
+        # Examples:
+        #   truncate --size 0 /var/log/syslog
+        Image|endswith: '/truncate'
+        CommandLine|contains|all:
+            - '0 '
+            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
+        CommandLine|contains:
+            - '-s '
+            - '-c '
+            - '--size'
+    selection_command_ln:
+        # Examples:
+        #   ln -sfn /dev/null /var/log/syslog
+        Image|endswith: '/ln'
+        CommandLine|contains|all:
+            - '/dev/null '
+            - '/var/log/syslog' # We use this to avoid re-writing a separate selection
+        CommandLine|contains:
+            - '-sf '
+            - '-sfn '
+            - '-sfT '
+    selection_command_cp:
+        # Examples:
+        #   cp /dev/null /var/log/syslog
+        Image|endswith: '/cp'
+        CommandLine|contains: '/dev/null'
+    selection_command_shred:
+        # Examples:
+        #   shred -u /var/log/syslog
+        Image|endswith: '/shred'
+        CommandLine|contains: '-u '
+    selection_unique_other:
         CommandLine|contains:
-            - 'rm /var/log/syslog'
-            - 'rm -r /var/log/syslog'
-            - 'rm -f /var/log/syslog'
-            - 'rm -rf /var/log/syslog'
-            - 'unlink /var/log/syslog' # removed other variants because of potential mixup with rm, unlink doesnt support those flags
-            - 'mv /var/log/syslog'
-            - ' >/var/log/syslog'
             - ' > /var/log/syslog'
-            - 'cp /dev/null /var/log/syslog'
-            - 'ln -sf /dev/null /var/log/syslog'   # link command variants
-            - 'ln -sfn /dev/null /var/log/syslog'
-            - 'ln -sfT /dev/null /var/log/syslog'
-            - 'truncate -s 0 /var/log/syslog'    # truncate command variants
-            - 'truncate -c -s 0 /var/log/syslog'
-            - 'truncate --size 0 /var/log/syslog'
-            - 'truncate --size=0 /var/log/syslog'
-            - 'shred -u /var/log/syslog'
+            - ' >/var/log/syslog'
             - ' >| /var/log/syslog'  # redirection empties w spacing, noclobber
-            - '>|/var/log/syslog'
-            - ':>/var/log/syslog'
-            - ':> /var/log/syslog'
             - ': > /var/log/syslog'
+            - ':> /var/log/syslog'
+            - ':>/var/log/syslog'
+            - '>|/var/log/syslog'
+    selection_unique_journalctl:
+        CommandLine|contains:
             - 'journalctl --vacuum'
             - 'journalctl --rotate' # archives current journal files and creates new empty ones
-    condition: selection
+    condition: (selection_file and 1 of selection_command_*) or 1 of selection_unique_*
 falsepositives:
     - Log rotation.
     - Maintenance.