System Log Files Cleared via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to clear system log files, specifically '/var/log/', via a remote SSH connection. It looks for the string "> /var/log/" within TCP traffic on port 22 (SSH) flowing from a client to a server, ignoring case. This activity is often associated with an attacker trying to cover their tracks by removing evidence of their presence.