Query: rule covering Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste
Matching passage: Sigma rule: Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux syste. Logsource: linux / process_creation. Rule: title: Disable Or Stop Services id: de25eeb8-3655-4643-ac3a-b662d3f26b6b status: test description: 'Detects the usage of utilities such as ''systemctl'', ''service''...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations. ' references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 modified: 2025-03-18 tags: - attack.defense-impairment - attack.t1685 - attack.impact - attack.t1489 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /service - /systemctl - /chkconfig CommandLine|contains: - ' stop ' - ' disable ' filter_main_legit_snapd: Image|endswith: /systemctl CommandLine|contains: - --no-reload disable snap-snapd- - ' stop snap-snapd-' filter_main_ssh_preinstall: Image|endswith: /systemctl ParentCommandLine|contains: tmp.ci/preinst upgrade CommandLine|contains|all: - ' stop ' - ssh. filter_main_ubuntu_upgrade: ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade Image|endswith: /systemctl filter_optional_aws_agent: Image|endswith: /systemctl CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activities - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Near-miss passage: Sigma rule: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands. Logsource: windows / process_creation. Rule: title: Suspicious Command Patterns In Scheduled Task Creation id: f2c64357-b1d2-41b7-849f-34d2682c0fad status: test description: Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands references: - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/ - https://twitter.com/RedDrip7/status/1506480588827467785 - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf author: Florian Roth (Nextron Systems) date: 2022-02-23 modified: 2024-03-19 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_schtasks: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_pattern_1: CommandLine|contains: - '/sc minute ' - '/ru system ' selection_pattern_2: CommandLine|contains: - cmd /c - cmd /k - cmd /r - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' selection_uncommon: CommandLine|contains: - ' -decode ' - ' -enc ' - ' -w hidden ' - ' bypass ' - ' IEX' - .DownloadData - .DownloadFile - .DownloadString - '/c start /min ' - FromBase64String - mshta http - mshta.exe http selection_anomaly_1: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\ - '%AppData%' - '%Temp%' - '%tmp%' selection_anomaly_2: CommandLine|contains: - cscript - curl - wscript condition: selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* ) falsepositives: - Software installers that run from temporary folders and also install scheduled tasks are expected to generate some false positives level: high