Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Disabling Security Tools - Builtin

Detects disabling security tools

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Ömer Günal, Alejandro Ortuno, oscd.communityCreated Wed Jun 17Updated Sat Nov 2649f5dfc1-f92e-4d34-96fa-feba3f6acf36linux
Log Source
Linuxsyslog
ProductLinux← raw: linux
Servicesyslog← raw: syslog
Detection Logic
Detection Logic1 selector
detection:
    keywords:
        - 'stopping iptables'
        - 'stopping ip6tables'
        - 'stopping firewalld'
        - 'stopping cbdaemon'
        - 'stopping falcon-sensor'
    condition: keywords
False Positives

Legitimate administration activities

References
1
Resolving title…
github.com
MITRE ATT&CK
Related Rules
DerivedDetectionmedium

Disabling Security Tools

Detects disabling security tools

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
49f5dfc1-f92e-4d34-96fa-feba3f6acf36
Status
test
Level
medium
Type
Detection
Created
Wed Jun 17
Modified
Sat Nov 26
Author
Ömer Günal, Alejandro Ortuno, oscd.community
Path
rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml
Raw Tags
attack.defense-evasionattack.t1562.004
View on GitHub