Detection Strategy for Disable or Modify Linux Audit System

ID: DET0062
Domains: Enterprise
Analytics: AN0171
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN0171

Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.

Log Sources
Data Component Name Channel
Command Execution (DC0064) auditd:EXECVE Execution of auditctl, systemctl stop auditd, or kill -9 auditd
Process Modification (DC0020) auditd:SYSCALL kill syscalls targeting auditd process
File Modification (DC0061) auditd:FILE Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf
Service Metadata (DC0041) linux:syslog auditd service stopped or disabled
Mutable Elements
Field Description
ServiceWhitelist Exclude legitimate administrative service stops during system maintenance.
FilePathScope Specify monitored paths (/etc/audit/audit.rules, audit.conf) to avoid false positives from unrelated file writes.
TimeWindow Correlate suspicious commands, file modifications, and audit log gaps in short succession.