((Image:\/rm OR Image:\/rmdir OR Image:\/shred OR Image:\/unlink) (CommandLine:\/var\/log* OR CommandLine:\/var\/spool\/mail*)) (-((Image:\/rm CommandLine:rm\ \-f\ \/var\/log\/sysstat\/*) OR (Image:\/rm CommandLine:rm\ \-f\ \-\-\ \/var\/log\/\/dmesg*)))