Command Line
yum remove [APP] -y
Description
Cyber threats may attempt to uninstall or remove security or backup related applications.
Risk
Low
Risk Reason
This is an extremely common activity - filtering for the removal of security products specifically could raise the level of suspicion as these are not typically meant to be removed.
Fidelity
Low
Fidelity Reason
It is nearly impossible to alert on this type of activity unless you are filtering for very specific packages such as security software that is deployed in the domain.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1562/001
Description: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)
Tactics: