Linux Login Records Manipulation
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp). Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact. Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sigma
