{"id":"e3a8a052-111f-4606-9aee-f28ebeb76776","title":"Disabling Security Tools","description":"Detects disabling security tools","author":"Ömer Günal, Alejandro Ortuno, oscd.community","status":"test","level":"medium","date":"2020-06-17","modified":"2022-10-09","tags":["attack.defense-impairment","attack.t1686"],"technique_ids":["T1686"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md"],"source_path":"rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml","source_sha256":"9aa10776a769dbf4a5dbcee8cfbe0216f430154ad30abd6d137ae3f100eb4841","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disabling Security Tools\nid: e3a8a052-111f-4606-9aee-f28ebeb76776\nstatus: test\ndescription: Detects disabling security tools\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md\nauthor: Ömer Günal, Alejandro Ortuno, oscd.community\ndate: 2020-06-17\nmodified: 2022-10-09\ntags:\n    - attack.defense-impairment\n    - attack.t1686\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_iptables_1:\n        Image|endswith: '/service'\n        CommandLine|contains|all:\n            - 'iptables'\n            - 'stop'\n    selection_iptables_2:\n        Image|endswith: '/service'\n        CommandLine|contains|all:\n            - 'ip6tables'\n            - 'stop'\n    selection_iptables_3:\n        Image|endswith: '/chkconfig'\n        CommandLine|contains|all:\n            - 'iptables'\n            - 'stop'\n    selection_iptables_4:\n        Image|endswith: '/chkconfig'\n        CommandLine|contains|all:\n            - 'ip6tables'\n            - 'stop'\n    selection_firewall_1:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'firewalld'\n            - 'stop'\n    selection_firewall_2:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'firewalld'\n            - 'disable'\n    selection_carbonblack_1:\n        Image|endswith: '/service'\n        CommandLine|contains|all:\n            - 'cbdaemon'\n            - 'stop'\n    selection_carbonblack_2:\n        Image|endswith: '/chkconfig'\n        CommandLine|contains|all:\n            - 'cbdaemon'\n            - 'off'\n    selection_carbonblack_3:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'cbdaemon'\n            - 'stop'\n    selection_carbonblack_4:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'cbdaemon'\n            - 'disable'\n    selection_selinux:\n        Image|endswith: '/setenforce'\n        CommandLine|contains: '0'\n    selection_crowdstrike_1:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'stop'\n            - 'falcon-sensor'\n    selection_crowdstrike_2:\n        Image|endswith: '/systemctl'\n        CommandLine|contains|all:\n            - 'disable'\n            - 'falcon-sensor'\n    condition: 1 of selection*\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1686","id":"T1686","name":"Disable or Modify System Firewall","page":"techniques/enterprise/T1686/"}],"data_path":"data/detection-rules/e3a8a052-111f-4606-9aee-f28ebeb76776.json","kind":"sigma"}