diff --git a/nursery/clear-system-logs-via-journalctl.yml b/nursery/clear-system-logs-via-journalctl.yml
new file mode 100644
index 000000000..4ab289893
--- /dev/null
+++ b/nursery/clear-system-logs-via-journalctl.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: clear system logs via journalctl
+    namespace: anti-analysis/anti-forensic/clear-logs
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Defense Evasion::Indicator Removal::Clear Linux or Mac System Logs [T1070.002]
+    examples:
+      - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b
+  features:
+    - and:
+      - os: linux
+      - string: /\bjournalctl\s+(--?\S+\s+)*--(rotate|vacuum-time|vacuum-size|vacuum-files)/
diff --git a/nursery/interact-with-systemd-journal-via-journalctl.yml b/nursery/interact-with-systemd-journal-via-journalctl.yml
new file mode 100644
index 000000000..99e6a0653
--- /dev/null
+++ b/nursery/interact-with-systemd-journal-via-journalctl.yml
@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: interact with systemd journal via journalctl
+    namespace: host-interaction/log
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b
+  features:
+    - and:
+      - os: linux
+      - string: /\bjournalctl\s+-/
diff --git a/nursery/manage-system-services-via-systemctl.yml b/nursery/manage-system-services-via-systemctl.yml
new file mode 100644
index 000000000..abb05ac24
--- /dev/null
+++ b/nursery/manage-system-services-via-systemctl.yml
@@ -0,0 +1,18 @@
+rule:
+  meta:
+    name: manage system services via systemctl
+    namespace: host-interaction/service
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Impact::Service Stop [T1489]
+      - Persistence::Create or Modify System Process::Systemd Service [T1543.002]
+    examples:
+      - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b
+  features:
+    - and:
+      - os: linux
+      - string: /\bsystemctl\s+(--?\S+\s+)*(daemon-reload|daemon-reexec|start|stop|restart|reload|enable|disable|mask|unmask|kill|reset-failed)\b/