Techniques › T1687 › AN2039
AN2039 Analytic 2039
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects exploitation attempts against security daemons or kernel security modules followed by daemon termination, disabled logging, module unload, audit stoppage, or reduced endpoint telemetry. Correlates local execution or network input with control degradation.</p>
- Detects
- T1687 Exploitation for Defense Impairment
- Part of
- DET0900 Detection of Defense Impairment
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:EXECVE | execve, kill, ptrace, insmod, rmmod targeting security processes | DC0064 Command Execution |
| auditd:DAEMON | auditd stopped, config changed, logging suspended | DC0041 Service Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProtectedProcessNames | Names of EDR, audit, AV, firewall daemons |
ModuleUnloadAllowlist | Approved maintenance unload operations |
HealthGapThreshold | Expected telemetry heartbeat tolerance |