{"id":"de25eeb8-3655-4643-ac3a-b662d3f26b6b","title":"Disable Or Stop Services","description":"Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.\nAttackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-15","modified":"2025-03-18","tags":["attack.defense-impairment","attack.t1685","attack.impact","attack.t1489"],"technique_ids":["T1489","T1685"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities","Some false positives are to be expected. Apply additional filters as needed before pushing to production."],"references":["https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml","source_sha256":"af5ee2d85cb12568445f6e47a1e460a78e5a87a4b06d0386268e918e71979aa3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Or Stop Services\nid: de25eeb8-3655-4643-ac3a-b662d3f26b6b\nstatus: test\ndescription: |\n    Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.\n    Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.\nreferences:\n    - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-15\nmodified: 2025-03-18\ntags:\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.impact\n    - attack.t1489\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith:\n            - '/service'\n            - '/systemctl'\n            - '/chkconfig'\n        CommandLine|contains:\n            - ' stop '\n            - ' disable '\n    filter_main_legit_snapd:\n        Image|endswith: '/systemctl'\n        CommandLine|contains:\n            - '--no-reload disable snap-snapd-'\n            - ' stop snap-snapd-'\n    filter_main_ssh_preinstall:\n        Image|endswith: '/systemctl'\n        ParentCommandLine|contains: 'tmp.ci/preinst upgrade'\n        CommandLine|contains|all:\n            - ' stop '\n            - 'ssh.'\n    filter_main_ubuntu_upgrade:\n        ParentCommandLine|contains: '/dpkg/info/ubuntu-pro-client.prerm upgrade'\n        Image|endswith: '/systemctl'\n    filter_optional_aws_agent:\n        Image|endswith: '/systemctl'\n        CommandLine|endswith: 'snap.amazon-ssm-agent.amazon-ssm-agent.service'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate administration activities\n    - Some false positives are to be expected. Apply additional filters as needed before pushing to production.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","page":"techniques/enterprise/T1489/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/de25eeb8-3655-4643-ac3a-b662d3f26b6b.json","kind":"sigma"}