UAT-8616 SD-WAN Defense Evasion — Log Tampering and History Wipe (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects attempts by a user or process to clear audit logs, system logs, or command history, often used by adversaries to cover their tracks on a compromised system. The rule monitors for file deletion (rm, shred), content truncation (truncate), selective line removal (sed -i), and shell history suppression (HISTFILE=/dev/null, history -c) against sensitive log and history paths.