Rule Info
Name
SSH Known Hosts File Removed or Cleared
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects removal or clearing of SSH known_hosts files via common CLI utilities.
Attackers delete known_hosts to erase evidence of lateral movement destinations and to
suppress SSH host key mismatch warnings when reconnecting to a host whose key has been changed.
Date
2026-08-19 00:00:00
Modified
None
Id
e7d3a1f2-4b8c-4e9d-c5b6-1f2e3d4a5b6c
Tags
attack.stealth attack.t1070.004
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR