Network Connection History Cleared via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•8

This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.