From 88c64dadccf70cb69afbeb6898d23188872ead90 Mon Sep 17 00:00:00 2001
From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com>
Date: Mon, 2 Nov 2026 13:58:57 +0330
Subject: [PATCH] Add Linux auditd audit rules removed dataset (T1562.001)

CONFIG_CHANGE op=remove_rule records of a runtime audit-rule flush
(auditctl -D / AUDIT_DEL) with no matching add_rule - the telemetry a
mass audit-rule removal produces - captured on an authorized lab host.
For the Linux Auditd Audit Rules Removed detection.
---
 .../linux_auditd_rules_removed/linux_auditd_rules_removed.log  | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 datasets/attack_techniques/T1562.001/linux_auditd_rules_removed/linux_auditd_rules_removed.log

diff --git a/datasets/attack_techniques/T1562.001/linux_auditd_rules_removed/linux_auditd_rules_removed.log b/datasets/attack_techniques/T1562.001/linux_auditd_rules_removed/linux_auditd_rules_removed.log
new file mode 100644
index 00000000..8b66eb3a
--- /dev/null
+++ b/datasets/attack_techniques/T1562.001/linux_auditd_rules_removed/linux_auditd_rules_removed.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3e40a3f70437392b7e721d9afd7f0df6add931aacc5d330c712ae4cffef24022
+size 1156