3BB: Anti-forensic log/history cleanup excluding routine maintenance

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.