ATT&CK technique
View on MITRE ATT&CK →
T1685.004
Disable or Modify Linux Audit System Log
Defense Impairment
4 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Linux Auditd Auditd Daemon Abort | production | 2026-05-13 |
| splunk | Linux Auditd Auditd Daemon Shutdown | production | 2026-05-13 |
| splunk | Linux Auditd Auditd Daemon Start | production | 2026-05-13 |
| sigma | Audit Rules Deleted Via Auditctl | experimental | 2025-10-17 |