CmdID / Techniques / T1685
T1685.004 Disable or Modify Tools: Disable or Modify Linux Audit System Log
Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection. MITRE ATT&CK
1 Sigma rule
T1685.004 on attack.mitre.org
Part of
MITRE ATT&CK
T1685Disable or Modify Tools
Sigma rules tagged with it
process creation, the highest levels first
Command lines CmdID reads as it
everyday examples from tldr-pages, CC BY 4.0
Delete all audit rules on the page for auditctl
An example is here when CmdID’s reading of it names T1685.004: a Sigma rule it trips is tagged with it, or its abuse is documented as it.