Attempt to Disable Auditd Service

[rule]
description = """
Adversaries may attempt to disable the Auditd service to evade detection. Auditd is a Linux service that provides system
auditing and logging. Disabling the Auditd service can prevent the system from logging important security events, which
can be used to detect malicious activity.
"""
id = "bf76a9f8-42dd-44cc-9e2f-d8693df31d59"
license = "Elastic License v2"
name = "Attempt to Disable Auditd Service"
os_list = ["linux"]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.name == "service" and process.args == "stop") or
  (process.name == "chkconfig" and process.args == "off") or
  (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
  (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
) and
process.args in ("auditd", "auditd.service") and
not (
  process.parent.executable like (
    "/var/lib/dpkg/info/auditd.prerm", "/usr/libexec/platform-python*"
  ) or
  (process.name == "systemctl" and process.parent.args == "/usr/lib/systemd/systemd-update-helper") or
  process.parent.args like (
    "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_*.py", "/var/lib/dpkg/info/auditd.prerm", "/var/tmp/rpm-tmp*"
  ) or
  process.parent.executable == "/opt/kaspersky/kesl/libexec/kesl" or
  process.parent.command_line like "*logrotate_script*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"