mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 01:45:21 +00:00
Update lnx_clear_logs.yml
This commit is contained in:
parent
1c4c5af99f
commit
378f663502
@ -10,14 +10,14 @@ logsource:
|
||||
product: linux
|
||||
category: process_creation
|
||||
detection:
|
||||
selection1:
|
||||
selection:
|
||||
ProcessName|endswith:
|
||||
- '/rm' # covers /rmdir as well
|
||||
- '/shred'
|
||||
CommandLine|contains:
|
||||
- '/var/log'
|
||||
- '/var/spool/mail'
|
||||
condition: selection1 and selection2
|
||||
condition: selection
|
||||
falsepositives:
|
||||
- Legitimate administration activities
|
||||
level: low
|
||||
|
Loading…
Reference in New Issue
Block a user