It looks at various indicators of compromise that are linked to malicious compromise. As one specific example, Pegasus is known to try and hide its tracks by de

It looks at various indicators of compromise that are linked to malicious compromise. As one specific example, Pegasus is known to try and hide its tracks by deleting some log files. Their deletion is incomplete and corrupts the log database though, so it produces a very traceable, "you have been hit by Pegasus" indicator. A (partial) list of Pegasus C&C servers is also known, and some iOS log files store hostnames you have connected to in the past. It's fairly standard IoC analysis -- lots of malware leave traces on the client endpoint in question.