• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    BeyondTrust appliance mass log deletion via sudo rm -f (SAWFLY)

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Arnold Chan@slaz
    •updated 3 days ago•1•0•3

    Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.

    Microsoft Sentinel (KQL)

    Tags

    T1070.004 - File DeletionTA0005 - StealthFile DeletionCommand ExecutionLinuxkql

    Found in

    • ARMORY CASTLE Exploits BeyondTrust Remote Support VulnerabilityLast updated 3 days ago
    • ARMORY CASTLE Exploits BeyondTrust Remote Support VulnerabilityLast updated 3 days ago
    • ARMORY CASTLE Exploits BeyondTrust Remote Support VulnerabilityLast updated 3 days ago
    • ARMORY CASTLE Exploits BeyondTrust Remote Support VulnerabilityLast updated 3 days ago
    • ARMORY CASTLE Exploits BeyondTrust Remote Support VulnerabilityLast updated 3 days ago

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?