They already did: > Researchers have noted instances where devices known to be active had their shutdown.log cleared, alongside other IOCs for Pegasus infectio

They already did: > Researchers have noted instances where devices known to be active had their shutdown.log cleared, alongside other IOCs for Pegasus infections. This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices. Which is why the article is pointing out that a cleared `shutdown.log` is no longer an indicator of Pegasus infections (because it now happens every boot.)