Syslog Cleared via Remote SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.