Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects an adversary stopping or disabling the Linux audit daemon (auditd), the primary kernel-level activity logging subsystem on Linux.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
