1200KM / detection
T1685.004 Disable or Modify Linux Audit System Log — Detection Rules
Detection workspace for T1685.004 Disable or Modify Linux Audit System Log: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Audit Rules Deleted Via Auditctl · experimental · high · {"product":"linux","category":"process_creation"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0062 Detection Strategy for Disable or Modify Linux Audit System Log
AN0171 Analytic 0171
Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1685.004 simulation workspace
- Command Execution · DC0064
- File Modification · DC0061
- Process Modification · DC0020
- Service Metadata · DC0041
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.