UAT-8616 SD-WAN Anti-Forensic: Log Deletion and Config File Restoration

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects command-line execution of 'rm' or 'cp -a' targeting specific sensitive system, credential, or configuration files on Linux systems. This behavior often indicates an attempt to remove evidence, destroy logs, or stage sensitive data for exfiltration.