Query: Sigma rule for Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste
Matching passage: Sigma rule: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste. Logsource: linux / process_creation. Rule: title: Disable Or Stop Services id: de25eeb8-3655-4643-ac3a-b662d3f26b6b status: test description: 'Detects the usage of utilities such as ''systemctl'', ''service''...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations. ' references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 modified: 2025-03-18 tags: - attack.defense-impairment - attack.t1685 - attack.impact - attack.t1489 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /service - /systemctl - /chkconfig CommandLine|contains: - ' stop ' - ' disable ' filter_main_legit_snapd: Image|endswith: /systemctl CommandLine|contains: - --no-reload disable snap-snapd- - ' stop snap-snapd-' filter_main_ssh_preinstall: Image|endswith: /systemctl ParentCommandLine|contains: tmp.ci/preinst upgrade CommandLine|contains|all: - ' stop ' - ssh. filter_main_ubuntu_upgrade: ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade Image|endswith: /systemctl filter_optional_aws_agent: Image|endswith: /systemctl CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activities - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Near-miss passage: Sigma rule: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Eventlog Cleared id: a62b37e0-45d3-48d9-a517-90c1a1b0186b related: - id: f2f01843-e7b8-4f95-a35a-d23584476423 type: obsolete - id: d99b79d2-0a6f-4f46-ad8b-260b6e17f982 type: derived - id: 100ef69e-3327-481c-8e5c-6d80d9507556 type: derived status: test description: One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-01-10 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog filter_main_covered: Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection and not 1 of filter_main_* falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: medium