Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine has_any ("auditctl -e 0", "systemctl stop auditd", "service auditd stop", "killall auditd", "pkill auditd") | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName

DeviceProcessEvents | where InitiatingProcessCommandLine contains 'auditctl -e 0' or InitiatingProcessCommandLine contains 'service auditd stop' or InitiatingProcessCommandLine contains '/etc/init.d/auditd stop' or InitiatingProcessCommandLine contains 'systemctl stop auditd' | project DeviceName, AccountName, InitiatingProcessCommandLine, TimeGenerated

DeviceProcessEvents | where ProcessCommandLine has_any ('auditctl -e 0', 'auditctl --disable', 'systemctl stop auditd', 'service auditd stop', 'auditd -s disable', 'systemctl disable auditd') | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("auditctl", "magic value", "d off", "auditd -s disable", "auditd") or ProcessCommandLine has_any ("auditctl", "magic value", "d off", "auditd -s disable", "auditd")

DeviceProcessEvents | where InitiatingProcessCommandLine has_any ("auditctl", "systemctl stop auditd", "service auditd stop", "kill") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessId

let linuxDevices = DeviceInfo | where OSPlatform == 'Linux' | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where ProcessCommandLine contains 'auditctl' and ProcessCommandLine contains '-e 0' | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents | where ActionType == "ProcessCreated" | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId ) on DeviceId | extend normCmdLine = tolower(ProcessCommandLine) | where normCmdLine has_any ("auditctl", "systemctl", "service") and normCmdLine has_any ("-e 0", "stop", "disable") | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, FileName | order by TimeGenerated desc | limit 100

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | project DeviceId; union DeviceProcessEvents, DeviceEvents | where DeviceId in (LinuxDevices) | where tostring(ProcessCommandLine) != "" // ensure we have commands | where tolower(ProcessCommandLine) has_any ("auditctl -e 0", "systemctl stop auditd", "service auditd stop", "systemctl disable auditd", "chkconfig auditd off", "systemctl mask auditd") // Add additional keywords if necessary | project TimeGenerated, DeviceName, ActionType, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, AdditionalFields | order by TimeGenerated desc

union withsource=SourceTable DeviceProcessEvents, DeviceEvents | where ( // Check command line fields from process execution events ((ProcessCommandLine has "auditctl" or ProcessCommandLine has "auditd" or ProcessCommandLine has "systemctl") and (ProcessCommandLine has "stop" or ProcessCommandLine has "disable" or ProcessCommandLine has "-e 0")) // Also check the initiating process command line or ((InitiatingProcessCommandLine has "auditctl" or InitiatingProcessCommandLine has "auditd" or InitiatingProcessCommandLine has "systemctl") and (InitiatingProcessCommandLine has "stop" or InitiatingProcessCommandLine has "disable" or InitiatingProcessCommandLine has "-e 0")) ) | project TimeGenerated, DeviceName, SourceTable, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath, ProcessId, InitiatingProcessId | order by TimeGenerated desc

union DeviceProcessEvents, DeviceEvents | where ( (isnotempty(InitiatingProcessCommandLine) and tolower(InitiatingProcessCommandLine) has "auditctl") or (isnotempty(InitiatingProcessCommandLine) and tolower(InitiatingProcessCommandLine) has "auditd") or (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) has "auditctl") or (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) has "auditd") or (tostring(AdditionalFields) has "auditctl") or (tostring(AdditionalFields) has "auditd") ) | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, AdditionalFields, Type | sort by TimeGenerated desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where TimeGenerated between (startofday(ago(7d))..now()) // adjust time range as needed | where DeviceId in (linuxDevices) | where (FileName == "auditctl" and ProcessCommandLine has "-e 0") or (FileName == "systemctl" and ProcessCommandLine has "auditd" and (ProcessCommandLine has "stop" or ProcessCommandLine has "disable")) or ProcessCommandLine has "service auditd stop" or ProcessCommandLine has "auditoff" or ProcessCommandLine has "chkconfig auditd off" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine | sort by TimeGenerated desc

let DisabledByProcess = DeviceProcessEvents | where ( ProcessCommandLine has "auditctl" and (ProcessCommandLine has "-e 0" or ProcessCommandLine has "--disable") or ProcessCommandLine has "systemctl stop auditd" or ProcessCommandLine has "systemctl disable auditd" or ProcessCommandLine has "service auditd stop" ) | project TimeGenerated, Source = "ProcessEvent", HostName = DeviceName, Account = InitiatingProcessAccountName, Command = ProcessCommandLine; let DisabledBySyslog = Syslog | where ( ProcessName == "auditd" and (SyslogMessage has "stopped" or SyslogMessage has "disabled") or SyslogMessage has "audit subsystem disabled" ) | project TimeGenerated, Source = "Syslog", HostName = Computer, Account = "", Command = SyslogMessage; union isfuzzy=true DisabledByProcess, DisabledBySyslog | sort by TimeGenerated desc