Elastic Defend high stable eql

Attempt to Disable Auditd Service

Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which can be used to detect malicious activity.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and (
  (process.name == "service" and process.args == "stop") or
  (process.name == "chkconfig" and process.args == "off") or
  (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
  (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
) and
process.args in ("auditd", "auditd.service") and
not (
  process.parent.executable like (
    "/var/lib/dpkg/info/auditd.prerm", "/usr/libexec/platform-python*"
  ) or
  (process.name == "systemctl" and process.parent.args == "/usr/lib/systemd/systemd-update-helper") or
  process.parent.args like (
    "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_*.py", "/var/lib/dpkg/info/auditd.prerm", "/var/tmp/rpm-tmp*"
  ) or
  process.parent.executable == "/opt/kaspersky/kesl/libexec/kesl" or
  process.parent.command_line like "*logrotate_script*"
)

Field Validations

Loading…

Comments (0)

Loading comments...