Support for systemd-related behaviors

nursery/clear-system-logs-via-journalctl.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: clear system logs via journalctl
+    namespace: anti-analysis/anti-forensic/clear-logs
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Defense Evasion::Indicator Removal::Clear Linux or Mac System Logs [T1070.002]
+    examples:
+      - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021
+  features:
+    - and:
+      - os: linux
+      - string: /\bjournalctl\s+(--?\S+\s+)*--(rotate|vacuum-time|vacuum-size|vacuum-files)/

nursery/interact-with-systemd-journal-via-journalctl.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: interact with systemd journal via journalctl
+    namespace: host-interaction/log
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Discovery::System Information Discovery [T1082]
+    examples:
+      - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021
+  features:
+    - and:
+      - os: linux
+      - string: /\bjournalctl\s+-/

nursery/manage-system-services-via-systemctl.yml

@@ -0,0 +1,18 @@
+rule:
+  meta:
+    name: manage system services via systemctl
+    namespace: host-interaction/service
+    authors:
+      - still@teamt5.org
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Impact::Service Stop [T1489]
+      - Persistence::Create or Modify System Process::Systemd Service [T1543.002]
+    examples:
+      - 6a5bda892608df18c543036b71f46dd2ae533c85256c40dffeb23ea78c70f021
+  features:
+    - and:
+      - os: linux
+      - string: /\bsystemctl\s+(--?\S+\s+)*(daemon-reload|daemon-reexec|start|stop|restart|reload|enable|disable|mask|unmask|kill|reset-failed)\b/