Linux Auditd Service Disabled or Stopped
Detects an adversary stopping or disabling the Linux audit daemon (auditd), the primary kernel-level activity logging subsystem on Linux. Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events. Effectively attempting to blind the host's logging pipeline before further action. Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
Sigma
