Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Linux Auditd Service Restarted

The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line…

Description

The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.

Detection logic

Detection requirements

Platform
Linux

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_proctitle

Known benign triggers

  • Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice