Linux Auditd Service Disabled via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.