huntrule

Linux Syslog Alerts for Stopping Built-in Security Tools

Alerts on syslog text indicating security tools are being stopped: iptables, firewalld, cbdaemon, or falcon-sensor.

FreeReviewedSigma · Medium · v3
Product
linux
Service
syslog
Author
Ömer Günal, Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published
2020-06-17
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags syslog events containing keywords that indicate an attempt to stop built-in security components, such as stopping iptables/ip6tables, firewalld, cbdaemon, or falcon-sensor. Attackers may disable defensive tooling to reduce visibility and control system behavior. The detection relies on text-matching these stop-related phrases in Linux syslog telemetry.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange
Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)
Malicious Firewall Deactivation - PowerShell (via powershell)
Malicious Firewall Deactivation - Firewall (via firewall-as)
Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall
Malicious Windows Firewall Disable via Netsh
OpenSSH Server Firewall Configuration on Windows - Firewall (via firewall-as)
Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)
Suspicious Firewall Rule Masquerading as CloudExperienceHost via netsh
Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)
Linux Syslog Alerts for Stopping Built-in Security Tools
Pivot detection · T1686 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.