Nginx or Crash Log Deletion
Detects command-line activity indicating the deletion of crash core dump files or Nginx logs. This behavior was observed by CL-STA-1132 as a defense evasion technique to cover tracks after exploiting CVE-2026-0300.
Cortex XDR
