Log/history scrubbing of tmp/wget/cron/crond keywords via jasper-log stager

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects the use of common Linux command-line utilities (sed, grep, awk, bash, sh) to perform operations on sensitive system logs or shell history files. The rule targets command strings indicative of log modification, filtering, or removal of audit trails, often associated with an attacker attempting to conceal malicious activity.