tfMITRE ATT&CK sub-technique

Disable or Modify Linux Audit System Log T1685.004

sub-technique of T1685 Disable or Modify Tools

Tactic: Defense Impairment
Platform: Linux
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributor: Tim (Wadhwa-)Brown

Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Disable or Modify Linux Audit System Log MITRE reference T1685.004

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

EburyS0377 ↗

Disables OpenSSH, system (systemd), and audit logs (/sbin/auditd) when the backdoor is active.1

created 2019-04-19MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1685.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3

first rule: 2024 Q3

Disable or Modify Linux Audit System Log detection strategy DET0062

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Disable or Modify Linux Audit System Log

Enterprise

1 platform

AN0171 · Linux

Disabling or modifying the Linux Audit system through process termination (auditd killed), service management (systemctl stop auditd), or tampering with rule/configuration files (/etc/audit/audit.rules, audit.conf). Defender view: suspicious execution of auditctl/systemctl commands, file modifications to audit rules, or sudden absence of audit logs correlated with privileged execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	auditd:SYSCALL	kill syscalls targeting auditd process
Service MetadataDC0041	linux:syslog	auditd service stopped or disabled
File ModificationDC0061	auditd:FILE	Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf
Command ExecutionDC0064	auditd:EXECVE	Execution of auditctl, systemctl stop auditd, or kill -9 auditd

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceWhitelist	Exclude legitimate administrative service stops during system maintenance.
FilePathScope	Specify monitored paths (/etc/audit/audit.rules, audit.conf) to avoid false positives from unrelated file writes.
TimeWindow	Correlate suspicious commands, file modifications, and audit log gaps in short succession.

AuditM1047

Routinely check account role permissions to ensure only expected users and roles have permission to modify logging settings. To ensure Audit rules can not be modified at runtime, add the auditctl -e 2 as the last command in the audit.rules files. Once started, any attempt to change the configuration in this mode will be audited and denied. The configuration can only be changed by rebooting the machine.

User Account ManagementM1018

An adversary must already have root level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

Tests2Executorssh 2Need elevation2 of 2Have prerequisites2Have cleanup2Platformslinux

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Delete all auditd rules using auditctl	linux	sh	Required	1	Yes
Using 'auditctl -D' deletes all existing audit rules, resulting in the loss of previously configured monitoring settings and the audit trail. This action reduces visibility into system activities, potentially leading to compliance concerns and hampering security monitoring efforts. Additionally, it poses a risk of covering unauthorized activities by erasing evidence from audit logs. Attack command auditctl -D Cleanup command service auditd restart Prerequisite Check if auditd is installed. Check if [ $(command -v auditctl) ]; then exit 0; else exit 1; fi Satisfy (yum install auditd -y) \|\| (apt-get install auditd -y) \|\| (dnf install auditd -y) GUIDfa7cb8d5-e243-441d-bd05-9193b070ddb9
02	Disable auditd using auditctl	linux	sh	Required	1	Yes
The command `auditctl -e 0` disables the audit system. By setting the parameter to `0`, auditing is deactivated, halting the monitoring and recording of security-related events. This action stops the generation of audit logs, ceasing the collection of data regarding system activities. Disabling auditing may be done for various reasons, such as troubleshooting, performance optimization, or temporarily suspending auditing requirements, but it reduces visibility into system events and can impact security monitoring and compliance efforts. Attack command auditctl -e 0 Cleanup command auditctl -e 1 Prerequisite Check if auditd is installed. Check if [ $(command -v auditctl) ]; then exit 0; else exit 1; fi Satisfy (yum install auditd -y) \|\| (apt-get install auditd -y) \|\| (dnf install auditd -y) GUIDb1ec12ce-fe44-4f2f-8a3d-40d74bbec8cb

Tests from Atomic Red Team (MIT licence) · technique definition

Disable or Modify Linux Audit System Log detections T1685.004

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs