kevmap

TechniquesT1687 › AN2039

AN2039 Analytic 2039

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects exploitation attempts against security daemons or kernel security modules followed by daemon termination, disabled logging, module unload, audit stoppage, or reduced endpoint telemetry. Correlates local execution or network input with control degradation.</p>
Detects
T1687 Exploitation for Defense Impairment
Part of
DET0900 Detection of Defense Impairment

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:EXECVEexecve, kill, ptrace, insmod, rmmod targeting security processesDC0064 Command Execution
auditd:DAEMONauditd stopped, config changed, logging suspendedDC0041 Service Metadata

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ProtectedProcessNamesNames of EDR, audit, AV, firewall daemons
ModuleUnloadAllowlistApproved maintenance unload operations
HealthGapThresholdExpected telemetry heartbeat tolerance