Linux auditctl -D used to delete all audit rules
Flags auditctl -D executions that delete all audit rules and watchers on Linux.
- Product
- linux
- Category
- process_creation
- Author
- Mohamed LAKRI (SigmaHQ), DRL 1.1
- Published
- 2025-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where auditctl is run with the -D option to delete all configured audit rules and watches on a Linux system. Disabling auditing can help an attacker reduce visibility and hinder post-compromise detection and investigation. It relies on Linux process creation telemetry that includes the executable path and command-line arguments to identify the -D usage.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux auditctl -D used to delete all audit rules
id: 27c1ec08-9d91-4e68-bbc1-55216d8e5b03
status: experimental
description: This rule flags process executions where auditctl is run with the -D option to delete all configured audit rules and watches on a Linux system. Disabling auditing can help an attacker reduce visibility and hinder post-compromise detection and investigation. It relies on Linux process creation telemetry that includes the executable path and command-line arguments to identify the -D usage.
references:
- https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012
- https://linux.die.net/man/8/auditct
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml
author: Mohamed LAKRI, Huntrule Team
date: 2025-10-17
tags:
- attack.defense-impairment
- attack.t1685.004
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: /auditctl
CommandLine|re: -D
condition: selection
falsepositives:
- An administrator troubleshooting. Investigate all attempts.
level: high
license: DRL-1.1
related:
- id: bed26dea-4525-47f4-b24a-76e30e44ffb0
type: derived