Clear Linux Logs

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•52

Detects attempts to clear logs on the system by identifying command-line executions of 'rm', 'shred', or 'unlink' targeting common log directories like '/var/log' and '/var/spool/mail'. Adversaries may clear system logs to hide evidence of an intrusion.