Linux Login Records Tampering via Interpeters
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp). This rule looks for the use of common interpeters in the context of editing binary login files. Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
Sigma
