Linux Package Removal via yum, apt, dpkg, or rpm Commands

title: Linux Package Removal via yum, apt, dpkg, or rpm Commands
id: a44b6daf-b9b4-47a1-94cd-aacd7b1620d3
status: test
description: This rule flags Linux processes invoking package manager binaries (yum, apt/apt-get, dpkg, or rpm) with command-line arguments that indicate package removal. Attackers may remove software or artifacts to reduce traces or disrupt defenses, making package removal activity noteworthy for investigation. It relies on process creation telemetry, including the executable path and command-line arguments, to match removal-related keywords.
references:
  - https://sysdig.com/blog/mitre-defense-evasion-falco
  - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command
  - https://linuxhint.com/uninstall_yum_package/
  - https://linuxhint.com/uninstall-debian-packages/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml
author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-09
tags:
  - attack.stealth
  - attack.t1070
logsource:
  product: linux
  category: process_creation
detection:
  selection_yum:
    Image|endswith: /yum
    CommandLine|contains:
      - erase
      - remove
  selection_apt:
    Image|endswith:
      - /apt
      - /apt-get
    CommandLine|contains:
      - remove
      - purge
  selection_dpkg:
    Image|endswith: /dpkg
    CommandLine|contains:
      - "--remove "
      - " -r "
  selection_rpm:
    Image|endswith: /rpm
    CommandLine|contains: " -e "
  condition: 1 of selection_*
falsepositives:
  - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting).
level: low
license: DRL-1.1
related:
  - id: 95d61234-7f56-465c-6f2d-b562c6fedbc4
    type: derived