Linux Package Uninstall Commands via yum/apt/dpkg/rpm

title: Linux Package Uninstall Commands via yum/apt/dpkg/rpm
id: a44b6daf-b9b4-47a1-94cd-aacd7b1620d3
status: test
description: This rule flags Linux process executions of common package managers when they are used for package removal. Attackers may uninstall or remove software to reduce visibility, clear artifacts, or disrupt defenders’ tooling. The detection relies on process creation telemetry capturing the executable path (e.g., yum/apt/apt-get/dpkg/rpm) and command-line arguments indicating erase/remove/purge options.
references:
  - https://sysdig.com/blog/mitre-defense-evasion-falco
  - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command
  - https://linuxhint.com/uninstall_yum_package/
  - https://linuxhint.com/uninstall-debian-packages/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml
author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-09
tags:
  - attack.stealth
  - attack.t1070
logsource:
  product: linux
  category: process_creation
detection:
  selection_yum:
    Image|endswith: /yum
    CommandLine|contains:
      - erase
      - remove
  selection_apt:
    Image|endswith:
      - /apt
      - /apt-get
    CommandLine|contains:
      - remove
      - purge
  selection_dpkg:
    Image|endswith: /dpkg
    CommandLine|contains:
      - "--remove "
      - " -r "
  selection_rpm:
    Image|endswith: /rpm
    CommandLine|contains: " -e "
  condition: 1 of selection_*
falsepositives:
  - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting).
level: low
license: DRL-1.1
related:
  - id: 95d61234-7f56-465c-6f2d-b562c6fedbc4
    type: derived