{
  "model_id": "SOC.100",
  "name": "Security Tool Uninstalled",
  "description": "Security tool (auditd, fail2ban, rkhunter, clamav) removed — attacker disabling defences.",
  "threshold": 0.7,
  "evaluations": [
    {
      "name": "Removed",
      "type": "comparison",
      "left": "event.type",
      "operator": "==",
      "right": "package.removed",
      "weight": 3
    },
    {
      "name": "SecTool",
      "type": "comparison",
      "left": "event.raw.name",
      "operator": "IN",
      "right": [
        "auditd",
        "fail2ban",
        "rkhunter",
        "clamav",
        "apparmor",
        "osquery",
        "wazuh-agent"
      ],
      "weight": 5
    },
    {
      "name": "Logic",
      "type": "logical",
      "operator": "AND",
      "operands": [
        "Removed",
        "SecTool"
      ],
      "weight": 5
    }
  ],
  "actions": [
    {
      "type": "emit_alert",
      "reason": "Security tool removed: {event.raw.name} — possible defence evasion."
    }
  ],
  "mitre_tactics": [
    "Defense Evasion"
  ],
  "mitre_techniques": [
    "T1562.001"
  ],
  "severity": "high",
  "observables": [
    "event.raw.name"
  ]
}