Audit Rules Deleted Via Auditctl

Status: experimental
Severity: high
Log source: category process_creation, product linux
Author: Mohamed LAKRI
Source: github.com/SigmaHQ/sigma

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

Known false positives

An administrator troubleshooting. Investigate all attempts.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685.004` Disable or Modify Tools: Disable or Modify Linux Audit System Log

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: Audit Rules Deleted Via Auditctl
id: bed26dea-4525-47f4-b24a-76e30e44ffb0
status: experimental
description: |
    Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.
    This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
    Removal of audit rules can significantly impair detection of malicious activities on the affected system.
references:
    - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012
    - https://linux.die.net/man/8/auditct
author: Mohamed LAKRI
date: 2025-10-17
tags:
    - attack.defense-impairment
    - attack.t1685.004
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/auditctl'
        CommandLine|re: '-D'
    condition: selection
falsepositives:
    - An administrator troubleshooting. Investigate all attempts.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '/auditctl'
    CommandLine|re: '-D'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	regex_match	`-D`	`field:"CommandLine" kind:regex_match value:"-D"`
`Image`	ends_with	`/auditctl`	`field:"Image" kind:ends_with value:"/auditctl"`