Linux Service Management Tool Usage to Stop or Disable Services

Flags Linux service-control commands with stop/disable intent, while excluding selected benign upgrade and snap workflows.

FreeUnreviewedSigmamediumv1

linux-service-management-tool-usage-to-stop-or-disable-services-de25eeb8

title: Linux Service Management Tool Usage to Stop or Disable Services
id: f07c42e9-05ab-4d49-8a7a-fc9558f61f29
status: test
description: This rule identifies process executions of common Linux service control utilities (e.g., systemctl, service, chkconfig) when the command line includes stop or disable actions. Stopping or disabling services can be used to impair defenses, reduce monitoring, disrupt system functionality, or support persistence. The detection relies on process creation telemetry, matching executable path suffixes and command-line substrings, with several exclusions for known legitimate upgrade and snap-related workflows.
references:
  - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
modified: 2025-03-18
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /service
      - /systemctl
      - /chkconfig
    CommandLine|contains:
      - " stop "
      - " disable "
  filter_main_legit_snapd:
    Image|endswith: /systemctl
    CommandLine|contains:
      - --no-reload disable snap-snapd-
      - " stop snap-snapd-"
  filter_main_ssh_preinstall:
    Image|endswith: /systemctl
    ParentCommandLine|contains: tmp.ci/preinst upgrade
    CommandLine|contains|all:
      - " stop "
      - ssh.
  filter_main_ubuntu_upgrade:
    ParentCommandLine|contains: /dpkg/info/ubuntu-pro-client.prerm upgrade
    Image|endswith: /systemctl
  filter_optional_aws_agent:
    Image|endswith: /systemctl
    CommandLine|endswith: snap.amazon-ssm-agent.amazon-ssm-agent.service
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administration activities
  - Some false positives are to be expected. Apply additional filters as needed before pushing to production.
level: medium
license: DRL-1.1
related:
  - id: de25eeb8-3655-4643-ac3a-b662d3f26b6b
    type: derived

What it detects

This rule identifies process executions of common Linux service control utilities (e.g., systemctl, service, chkconfig) when the command line includes stop or disable actions. Stopping or disabling services can be used to impair defenses, reduce monitoring, disrupt system functionality, or support persistence. The detection relies on process creation telemetry, matching executable path suffixes and command-line substrings, with several exclusions for known legitimate upgrade and snap-related workflows.

Known false positives

Legitimate administration activities
Some false positives are to be expected. Apply additional filters as needed before pushing to production.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.