Linux Package Removal via yum, apt, dpkg, or rpm Commands
Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.
- Product
- linux
- Category
- process_creation
- Author
- Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-09
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux processes invoking package manager binaries (yum, apt/apt-get, dpkg, or rpm) with command-line arguments that indicate package removal. Attackers may remove software or artifacts to reduce traces or disrupt defenses, making package removal activity noteworthy for investigation. It relies on process creation telemetry, including the executable path and command-line arguments, to match removal-related keywords.
Reporting behind it
- sysdig.comhttps://sysdig.com/blog/mitre-defense-evasion-falco
- tutorialspoint.comhttps://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command
- linuxhint.comhttps://linuxhint.com/uninstall_yum_package/
- linuxhint.comhttps://linuxhint.com/uninstall-debian-packages/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Package Removal via yum, apt, dpkg, or rpm Commands
id: a44b6daf-b9b4-47a1-94cd-aacd7b1620d3
status: test
description: This rule flags Linux processes invoking package manager binaries (yum, apt/apt-get, dpkg, or rpm) with command-line arguments that indicate package removal. Attackers may remove software or artifacts to reduce traces or disrupt defenses, making package removal activity noteworthy for investigation. It relies on process creation telemetry, including the executable path and command-line arguments, to match removal-related keywords.
references:
- https://sysdig.com/blog/mitre-defense-evasion-falco
- https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command
- https://linuxhint.com/uninstall_yum_package/
- https://linuxhint.com/uninstall-debian-packages/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml
author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-09
tags:
- attack.stealth
- attack.t1070
logsource:
product: linux
category: process_creation
detection:
selection_yum:
Image|endswith: /yum
CommandLine|contains:
- erase
- remove
selection_apt:
Image|endswith:
- /apt
- /apt-get
CommandLine|contains:
- remove
- purge
selection_dpkg:
Image|endswith: /dpkg
CommandLine|contains:
- "--remove "
- " -r "
selection_rpm:
Image|endswith: /rpm
CommandLine|contains: " -e "
condition: 1 of selection_*
falsepositives:
- Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting).
level: low
license: DRL-1.1
related:
- id: 95d61234-7f56-465c-6f2d-b562c6fedbc4
type: derived