SigmaHQ/rules/linux/lnx_security_tools_disabling.yml

action: global
title: Disabling Security Tools
id: e3a8a052-111f-4606-9aee-f28ebeb76776
status: experimental
description: Detects disabling security tools
author: Ömer Günal, Alejandro Ortuno, oscd.community
date: 2020/06/17
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md
falsepositives:
    - Legitimate administration activities
level: medium
tags:
    - attack.defense_evasion
    - attack.t1562.004
    - attack.t1089 # an old one
---
logsource:
    category: process_creation
    product: linux
detection:
    iptables_1:
        Image|endswith: '/service'
        CommandLine|contains|all:
          - 'iptables'
          - 'stop'
    iptables_2:
        Image|endswith: '/service'
        CommandLine|contains|all:
          - 'ip6tables'
          - 'stop'
    iptables_3:
        Image|endswith: '/chkconfig'
        CommandLine|contains|all:
          - 'iptables'
          - 'stop'
    iptables_4:
        Image|endswith: '/chkconfig'
        CommandLine|contains|all:
          - 'ip6tables'
          - 'stop'
    firewall_1:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'firewalld'
          - 'stop'
    firewall_2:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'firewalld'
          - 'disable'
    carbonblack_1:
        Image|endswith: '/service'
        CommandLine|contains|all:
          - 'cbdaemon'
          - 'stop'
    carbonblack_2:
        Image|endswith: '/chkconfig'
        CommandLine|contains|all:
          - 'cbdaemon'
          - 'off'
    carbonblack_3:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'cbdaemon'
          - 'stop'
    carbonblack_4:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'cbdaemon'
          - 'disable'
    selinux:
        Image|endswith: '/setenforce'
        CommandLine|contains: '0'
    crowdstrike_1:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'stop'
          - 'falcon-sensor'
    crowdstrike_2:
        Image|endswith: '/systemctl'
        CommandLine|contains|all:
          - 'disable'
          - 'falcon-sensor'
    condition: 1 of them
---
logsource:
    product: linux
    service: syslog
detection: 
    keywords:
        - '*stopping iptables*'
        - '*stopping ip6tables*'
        - '*stopping firewalld*'
        - '*stopping cbdaemon*'
        - '*stopping falcon-sensor*'
    condition: keywords