Anomalous Modification/Deletion of Acronis Backup Config or Data on Hosting Serv

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•4

Detects unauthorized attempts to modify, delete, or truncate backup configuration files and data directories associated with cPanel, WHM, and Plesk environments. This rule monitors for common file manipulation commands (e.g., rm, mv, truncate) targeting sensitive paths like /etc/acronis, /etc/cpanel/backups, and other backup-related directories, excluding actions performed by authorized service accounts.