Linux service commands stopping or disabling security tools (iptables, firewalld, cbdaemon, falcon-sensor, setenforce)

Flags Linux commands that stop/disable firewall/security services or set SELinux enforcement to 0.

FreeUnreviewedSigmamediumv1

linux-service-commands-stopping-or-disabling-security-tools-iptables-firewalld-c-e3a8a052

title: Linux service commands stopping or disabling security tools (iptables, firewalld, cbdaemon, falcon-sensor, setenforce)
id: 6c166716-026e-4be7-9515-5643f4d79a03
status: test
description: This rule identifies Linux process executions where administrators or attackers attempt to stop or disable security-related services. It matches commands to stop/disable firewall components (iptables, ip6tables, firewalld) and security agents (cbdaemon, falcon-sensor), and also set SELinux enforcement to permissive via setenforce 0. The detection relies on process creation telemetry, using the executable path suffix and command-line keywords observed at runtime.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml
author: Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-06-17
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  category: process_creation
  product: linux
detection:
  selection_iptables_1:
    Image|endswith: /service
    CommandLine|contains|all:
      - iptables
      - stop
  selection_iptables_2:
    Image|endswith: /service
    CommandLine|contains|all:
      - ip6tables
      - stop
  selection_iptables_3:
    Image|endswith: /chkconfig
    CommandLine|contains|all:
      - iptables
      - stop
  selection_iptables_4:
    Image|endswith: /chkconfig
    CommandLine|contains|all:
      - ip6tables
      - stop
  selection_firewall_1:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - firewalld
      - stop
  selection_firewall_2:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - firewalld
      - disable
  selection_carbonblack_1:
    Image|endswith: /service
    CommandLine|contains|all:
      - cbdaemon
      - stop
  selection_carbonblack_2:
    Image|endswith: /chkconfig
    CommandLine|contains|all:
      - cbdaemon
      - off
  selection_carbonblack_3:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - cbdaemon
      - stop
  selection_carbonblack_4:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - cbdaemon
      - disable
  selection_selinux:
    Image|endswith: /setenforce
    CommandLine|contains: "0"
  selection_crowdstrike_1:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - stop
      - falcon-sensor
  selection_crowdstrike_2:
    Image|endswith: /systemctl
    CommandLine|contains|all:
      - disable
      - falcon-sensor
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: e3a8a052-111f-4606-9aee-f28ebeb76776
    type: derived

What it detects

This rule identifies Linux process executions where administrators or attackers attempt to stop or disable security-related services. It matches commands to stop/disable firewall components (iptables, ip6tables, firewalld) and security agents (cbdaemon, falcon-sensor), and also set SELinux enforcement to permissive via setenforce 0. The detection relies on process creation telemetry, using the executable path suffix and command-line keywords observed at runtime.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.