T1685.004 — Disable or Modify Linux Audit System Log

Tactic: Defense Impairment · Platforms: Linux

Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (1)

T1685.004 Disable or Modify Tools: Disable or Modify Linux Audit System Log

title: "T1685.004 Disable or Modify Tools: Disable or Modify Linux Audit System Log"
id: fc16b48f-2170-43c2-a964-7d0c98c6548c
description: 'Detection Strategy for Disable or Modify Linux Audit System Log. Retargeted from generic rm/mv/systemctl activity touching any path containing /etc/systemd/system/, which never referenced auditd or /etc/audit/* and rarely matched real systemctl argv, to auditd-specific disable actions: auditctl -e 0 or auditctl -D, systemctl stop/disable/mask against auditd, pkill/killall targeting the auditd process, and writes to /etc/audit/audit.rules or /etc/audit/auditd.conf. Tune using: ServiceWhitelist, FilePathScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1685/004
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_auditctl_disable:
    type: EXECVE
    exe|endswith: '/auditctl'
    a1: '-e'
    a2: '0'
  selection_auditctl_delete:
    type: EXECVE
    exe|endswith: '/auditctl'
    a1: '-D'
  selection_systemctl_auditd:
    type: EXECVE
    exe|endswith: '/systemctl'
    a1:
      - 'stop'
      - 'disable'
      - 'mask'
    a2|contains: 'auditd'
  selection_pkill_auditd_direct:
    type: EXECVE
    exe|endswith:
      - '/pkill'
      - '/killall'
    a1|contains: 'auditd'
  selection_pkill_auditd_flag:
    type: EXECVE
    exe|endswith:
      - '/pkill'
      - '/killall'
    a2|contains: 'auditd'
  selection_config_write:
    type: PATH
    name:
      - '/etc/audit/audit.rules'
      - '/etc/audit/auditd.conf'
    nametype: NORMAL

  condition: 1 of selection_*

falsepositives:
  - Authorized audit-policy changes during maintenance windows (temporarily lowering auditd verbosity, planned auditd restarts/upgrades, configuration management applying an approved audit.rules update) will also match; scope to ServiceWhitelist/FilePathScope/TimeWindow and require change-ticket correlation.

level: high

Related sub-techniques

Explore