splApache-2.0from splunk/security_content

Linux Auditd Data Destruction Command

The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_data_destruction_command.yml

`linux_auditd`  (proctitle = "*rm *" AND proctitle = "*-rf *" AND proctitle = "*--no-preserve-root*")
  | rename host as dest
  | rename comm as process_name
  | rename exe as process
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY proctitle dest
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `linux_auditd_data_destruction_command_filter`