BeyondTrust appliance mass log deletion via sudo rm -f (SAWFLY)
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Microsoft Sentinel (KQL)

Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.

Already have an account?