Linux Syslog Alert for Stopping Security Tools via Service Disruption

Alerts on syslog text indicating security tools are being stopped: iptables, firewalld, cbdaemon, or falcon-sensor.

FreeUnreviewedSigmamediumv1

linux-syslog-alert-for-stopping-security-tools-via-service-disruption-49f5dfc1

title: Linux Syslog Alert for Stopping Security Tools via Service Disruption
id: 46f18dca-9afc-4912-92b5-5464952fa384
related:
  - id: e3a8a052-111f-4606-9aee-f28ebeb76776
    type: derived
  - id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36
    type: derived
status: test
description: This rule flags Linux syslog messages containing keywords associated with stopping common security and defensive services (iptables, ip6tables, firewalld, cbdaemon, and falcon-sensor). Attackers may disable or impair security tooling to reduce monitoring and defensive controls during an intrusion. The detection relies on syslog text matches for the specified stop-related phrases.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml
author: Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-06-17
modified: 2022-11-26
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - stopping iptables
    - stopping ip6tables
    - stopping firewalld
    - stopping cbdaemon
    - stopping falcon-sensor
  condition: keywords
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1

What it detects

This rule flags Linux syslog messages containing keywords associated with stopping common security and defensive services (iptables, ip6tables, firewalld, cbdaemon, and falcon-sensor). Attackers may disable or impair security tooling to reduce monitoring and defensive controls during an intrusion. The detection relies on syslog text matches for the specified stop-related phrases.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.