Linux log/history wiping and security agent tampering (CL-UNK-1211)
Detects various anti-forensic and defensive evasion techniques on Linux systems, including clearing system and shell logs, bash/zsh history deletion or disabling, file timestomping via touch, and termination or tampering of security agents such as Cortex, Falcon, or Wazuh.
Microsoft Sentinel (KQL)
