SSH Known Hosts File Deleted

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects deletion of SSH known_hosts files via file deletion events. Complements the proc_creation variant by catching cases where the shell handles the operation directly (e.g. bare redirects, unlink syscalls) without spawning a traceable child process. Attackers remove known_hosts to erase lateral movement destinations and suppress SSH host key mismatch warnings.

2026-08-19 00:00:00

None

f1a3c5e7-2b4d-4f8e-d9c7-3e5f1a2b4c6d

attack.stealth attack.t1070.004

Nextron Sigma feed only (private)