SigmaHQ/rules/linux/lnx_security_tools_disabling.yml

title: Disabling Security Tools
id: e3a8a052-111f-4606-9aee-f28ebeb76776
status: experimental
description: Detects disabling security tools
author: Ömer Günal, Alejandro Ortuno
date: 2020/06/17
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1089/T1089.md
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md
logsource:
    category: process_creation
    product: linux
detection:
    keywords:
        - Command|contains:
          - 'service iptables stop'
          - 'chkconfig off iptables'
          - 'service ip6tables stop'
          - 'chkconfig off ip6tables'
          - 'systemctl stop firewalld'
          - 'systemctl disable firewalld'
        - CarbonBlack|contains:
          - 'service cbdaemon stop'
          - 'chkconfig off cbdaemon'
          - 'systemctl stop cbdaemon'
          - 'systemctl disable cbdaemon'
        - SELinux:
          - 'setenforce 0'
        - Crowdstrike|contains:
          - 'systemctl stop falcon-sensor.service'
          - 'systemctl disable falcon-sensor.service'
    condition: keywords
falsepositives:
    - Legitimate administration activities
level: medium
tags:
    - attack.defense_evasion
    - attack.t1562.004
    - attack.t1089