splApache-2.0from splunk/security_content

Linux Auditd Hardware Addition Swapoff

The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_hardware_addition_swapoff.yml

`linux_auditd` proctitle = "*swapoff*" AND proctitle = "*-a*"
  | rename host as dest
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY proctitle dest
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `linux_auditd_hardware_addition_swapoff_filter`