File Copied to _var_log - *nix [splunk-edr]

Threat actors may attempt to conceal their activities or manipulate system logs by copying files into the /var/log/ directory within a compromised environment. This technique may be employed to evade detection, establish persistence or obfuscate the threat actor's actions by blending in with legitimate log files. Once placed in the /var/log/ directory, adversaries may manipulate or delete these files to cover their tracks and impede forensic analysis. This use case detects files moved to /var/log either through terminal commands or by a program specifically designed to perform this action.