From 4ded48154e55cea5f625c8c01cfa0a24502254f8 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Mon, 20 Jul 2026 06:50:48 +0800 Subject: [PATCH 1/3] Initial support for systemd-related strings Signed-off-by: Still Hsu --- nursery/clear-system-logs-via-journalctl.yml | 17 +++++++++++++++++ ...act-with-systemd-journal-via-journalctl.yml | 17 +++++++++++++++++ .../manage-system-services-via-systemctl.yml | 18 ++++++++++++++++++ 3 files changed, 52 insertions(+) create mode 100644 nursery/clear-system-logs-via-journalctl.yml create mode 100644 nursery/interact-with-systemd-journal-via-journalctl.yml create mode 100644 nursery/manage-system-services-via-systemctl.yml diff --git a/nursery/clear-system-logs-via-journalctl.yml b/nursery/clear-system-logs-via-journalctl.yml new file mode 100644 index 000000000..4bc2db96a --- /dev/null +++ b/nursery/clear-system-logs-via-journalctl.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: clear system logs via journalctl + namespace: anti-analysis/anti-forensic/clear-logs + authors: + - still@teamt5.org + scopes: + static: file + dynamic: file + att&ck: + - Defense Evasion::Indicator Removal::Clear Linux or Mac System Logs [T1070.002] + examples: + - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + features: + - and: + - os: linux + - string: /\bjournalctl\s+(--?\S+\s+)*--(rotate|vacuum-time|vacuum-size|vacuum-files)/ diff --git a/nursery/interact-with-systemd-journal-via-journalctl.yml b/nursery/interact-with-systemd-journal-via-journalctl.yml new file mode 100644 index 000000000..a49741d66 --- /dev/null +++ b/nursery/interact-with-systemd-journal-via-journalctl.yml @@ -0,0 +1,17 @@ +rule: + meta: + name: interact with systemd journal via journalctl + namespace: host-interaction/log + authors: + - still@teamt5.org + scopes: + static: file + dynamic: file + att&ck: + - Discovery::System Information Discovery [T1082] + examples: + - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + features: + - and: + - os: linux + - string: /\bjournalctl\s+-/ diff --git a/nursery/manage-system-services-via-systemctl.yml b/nursery/manage-system-services-via-systemctl.yml new file mode 100644 index 000000000..c7587bc76 --- /dev/null +++ b/nursery/manage-system-services-via-systemctl.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: manage system services via systemctl + namespace: host-interaction/service + authors: + - still@teamt5.org + scopes: + static: file + dynamic: file + att&ck: + - Impact::Service Stop [T1489] + - Persistence::Create or Modify System Process::Systemd Service [T1543.002] + examples: + - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + features: + - and: + - os: linux + - string: /\bsystemctl\s+(--?\S+\s+)*(daemon-reload|daemon-reexec|start|stop|restart|reload|enable|disable|mask|unmask|kill|reset-failed)\b/ From 26aa1202a4ed1a391e56f46b5fcf04f618b0da32 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 25 Jul 2026 22:02:25 +0800 Subject: [PATCH 2/3] Replace sample referenced referenced in nursery/clear-system-logs-via-journalctl.yml Signed-off-by: Still Hsu --- nursery/clear-system-logs-via-journalctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/clear-system-logs-via-journalctl.yml b/nursery/clear-system-logs-via-journalctl.yml index 4bc2db96a..4ab289893 100644 --- a/nursery/clear-system-logs-via-journalctl.yml +++ b/nursery/clear-system-logs-via-journalctl.yml @@ -10,7 +10,7 @@ rule: att&ck: - Defense Evasion::Indicator Removal::Clear Linux or Mac System Logs [T1070.002] examples: - - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b features: - and: - os: linux From c1ca184247757e7fb147d1c8de87ab9aa07ff41d Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 25 Jul 2026 22:08:16 +0800 Subject: [PATCH 3/3] Replace referenced sample with smaller one Signed-off-by: Still Hsu --- nursery/interact-with-systemd-journal-via-journalctl.yml | 2 +- nursery/manage-system-services-via-systemctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nursery/interact-with-systemd-journal-via-journalctl.yml b/nursery/interact-with-systemd-journal-via-journalctl.yml index a49741d66..99e6a0653 100644 --- a/nursery/interact-with-systemd-journal-via-journalctl.yml +++ b/nursery/interact-with-systemd-journal-via-journalctl.yml @@ -10,7 +10,7 @@ rule: att&ck: - Discovery::System Information Discovery [T1082] examples: - - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b features: - and: - os: linux diff --git a/nursery/manage-system-services-via-systemctl.yml b/nursery/manage-system-services-via-systemctl.yml index c7587bc76..abb05ac24 100644 --- a/nursery/manage-system-services-via-systemctl.yml +++ b/nursery/manage-system-services-via-systemctl.yml @@ -11,7 +11,7 @@ rule: - Impact::Service Stop [T1489] - Persistence::Create or Modify System Process::Systemd Service [T1543.002] examples: - - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021 + - 9a065f123d185623b6cb6762bd5a21cf1b836fbaeae0ef85b58aa76a97d5077b features: - and: - os: linux