Linux log wiping plus security agent disabling on same host (CL-UNK-1211)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects correlated activity on Linux devices where system logs are wiped or truncated and security or auditing agents are stopped, disabled, or killed within a one-hour window.