Rule Info
Name
Linux Log File Content Cleared or Deleted via CLI Utilities
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects unusual CLI-based methods to clear or delete Linux log file contents, including
truncating to zero size, overwriting with /dev/null, and other methods. These techniques
are commonly used by attackers and ransomware to destroy forensic evidence before or after
malicious activity.
Date
2026-08-19 00:00:00
Modified
None
Id
c4f2e1b3-7a5d-4c9e-b8d6-2e3f1a0c5b7d
Tags
attack.defense-impairment attack.t1685.006
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR