Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
18,193
15,767
12,685
8,498
6,307
Detects an adversary stopping or disabling the Linux audit daemon (auditd), the primary kernel-level activity logging subsystem on Linux.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
Disabling auditd eliminates syscall-level telemetry including file access, process execution, and privilege escalation events.
Effectively attempting to blind the host's logging pipeline before further action.
Observed in: TeamTNT, Rocke cryptominer campaigns, post-exploitation frameworks (Metasploit, Sliver) during cleanup phases.
