{"id":"36388120-b3f1-4ce9-b50b-280d9a7f4c04","title":"Kaspersky Endpoint Security Stopped Via CommandLine - Linux","description":"Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.\nThis activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.\n","author":"Milad Cheraghi","status":"experimental","level":"high","date":"2025-10-18","modified":"","tags":["attack.execution","attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["System administrator manually stopping Kaspersky services"],"references":["https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm"],"source_path":"rules/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml","source_sha256":"9bcdb391135a2c7229ab355d45865b88855fc69385bd200406353e6adad1141b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Kaspersky Endpoint Security Stopped Via CommandLine - Linux\nid: 36388120-b3f1-4ce9-b50b-280d9a7f4c04\nstatus: experimental\ndescription: |\n  Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.\n  This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.\nreferences:\n    - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm\nauthor: Milad Cheraghi\ndate: 2025-10-18\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith:\n            # Note: Add the list of shells allowed in your environment that can be used to run init.d scripts.\n            - '/systemctl'\n            - '/bash'\n            - '/sh'\n        CommandLine|contains|all:\n            - 'stop'\n            - 'kesl'\n    condition: selection\nfalsepositives:\n    - System administrator manually stopping Kaspersky services\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/36388120-b3f1-4ce9-b50b-280d9a7f4c04.json","kind":"sigma"}