Auditd Rules Flushed to Remove Monitoring

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to flush auditd rules by looking for the command 'auditctl -D' within TCP traffic on port 22 (SSH). This action is often performed by attackers to remove monitoring and evade detection after gaining access to a system.