Linux: Kaspersky Endpoint Security stopped via command line (init.d/systemctl)

Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.

FreeUnreviewedSigmahighv1

linux-kaspersky-endpoint-security-stopped-via-command-line-init-d-systemctl-36388120

title: "Linux: Kaspersky Endpoint Security stopped via command line (init.d/systemctl)"
id: 7d0ecb05-a907-4b66-bb0d-4c352c3e2462
status: experimental
description: This rule identifies process executions where a command line includes both "stop" and "kesl" and the executable path ends with /systemctl, /bash, or /sh. It indicates an attempt to stop Kaspersky Endpoint Security on Linux, which can reduce host defenses. The detection relies on Linux process creation telemetry capturing the executable path and full command line arguments.
references:
  - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-10-18
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /systemctl
      - /bash
      - /sh
    CommandLine|contains|all:
      - stop
      - kesl
  condition: selection
falsepositives:
  - System administrator manually stopping Kaspersky services
level: high
license: DRL-1.1
related:
  - id: 36388120-b3f1-4ce9-b50b-280d9a7f4c04
    type: derived

What it detects

This rule identifies process executions where a command line includes both "stop" and "kesl" and the executable path ends with /systemctl, /bash, or /sh. It indicates an attempt to stop Kaspersky Endpoint Security on Linux, which can reduce host defenses. The detection relies on Linux process creation telemetry capturing the executable path and full command line arguments.

Known false positives

System administrator manually stopping Kaspersky services

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.