Techniques › T1685.004 › AN0171
AN0171 Analytic 0171
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.</p>
- Detects
- T1685.004 Disable or Modify Linux Audit System Log
- Part of
- DET0062 Detection Strategy for Disable or Modify Linux Audit System Log
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:EXECVE | Execution of auditctl, systemctl stop auditd, or kill -9 auditd | DC0064 Command Execution |
| auditd:SYSCALL | kill syscalls targeting auditd process | DC0020 Process Modification |
| auditd:FILE | Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf | DC0061 File Modification |
| linux:syslog | auditd service stopped or disabled | DC0041 Service Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ServiceWhitelist | Exclude legitimate administrative service stops during system maintenance. |
FilePathScope | Specify monitored paths (/etc/audit/audit.rules, audit.conf) to avoid false positives from unrelated file writes. |
TimeWindow | Correlate suspicious commands, file modifications, and audit log gaps in short succession. |