{"id":"T1685.004","name":"Disable or Modify Linux Audit System Log","url":"https://attack.mitre.org/techniques/T1685/004","tactics":["defense-impairment"],"platforms":["Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0062","stix_id":"x-mitre-detection-strategy--1d769567-7e82-47f4-8dc8-5a503f524134","name":"Detection Strategy for Disable or Modify Linux Audit System Log","url":"https://attack.mitre.org/detectionstrategies/DET0062","analytics":[{"id":"AN0171","stix_id":"x-mitre-analytic--3e9734aa-b9b4-4716-927c-27c2c2aa972e","name":"Analytic 0171","description":"Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.","url":"https://attack.mitre.org/detectionstrategies/DET0062#AN0171","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"Execution of auditctl, systemctl stop auditd, or kill -9 auditd","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"},{"name":"auditd:SYSCALL","channel":"kill syscalls targeting auditd process","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:FILE","channel":"Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-file"},{"name":"linux:syslog","channel":"auditd service stopped or disabled","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ServiceWhitelist","description":"Exclude legitimate administrative service stops during system maintenance."},{"field":"FilePathScope","description":"Specify monitored paths (/etc/audit/audit.rules, audit.conf) to avoid false positives from unrelated file writes."},{"field":"TimeWindow","description":"Correlate suspicious commands, file modifications, and audit log gaps in short succession."}],"live":true,"detection_strategies":["DET0062"],"techniques":["T1685.004"]}],"live":true,"version":"1.0","techniques":["T1685.004"]}],"sigma_rules":[{"id":"bed26dea-4525-47f4-b24a-76e30e44ffb0","title":"Audit Rules Deleted Via Auditctl","author":"Mohamed LAKRI","status":"experimental","level":"high","date":"2025-10-17","modified":null,"description":"Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.\nThis technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.\nRemoval of audit rules can significantly impair detection of malicious activities on the affected system.\n","references":["https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012","https://linux.die.net/man/8/auditct"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1685.004"],"path":"rules/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml","techniques":["T1685.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}