Splunk unknown stable spl
Linux Auditd Hardware Addition Swapoff
The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.
Detection Logic
`linux_auditd` proctitle = "*swapoff*"
AND proctitle = "*-a*"
| rename host as dest
| stats count min(_time) as firstTime max(_time) as lastTime
BY proctitle dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_hardware_addition_swapoff_filter`False Positives
- ⚠ administrator may disable swapping of devices in a linux host. Filter is needed.
Field Validations
Loading…
Comments (0)
Loading comments...