Linux Syslog Alerts for Stopping Built-in Security Tools

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags syslog events containing keywords that indicate an attempt to stop built-in security components, such as stopping iptables/ip6tables, firewalld, cbdaemon, or falcon-sensor. Attackers may disable defensive tooling to reduce visibility and control system behavior. The detection relies on text-matching these stop-related phrases in Linux syslog telemetry.

Reporting behind it

Related detections9 linkedT1686 — drag to rearrange

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

Malicious Firewall Deactivation - PowerShell (via powershell)

Malicious Firewall Deactivation - Firewall (via firewall-as)

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

Malicious Windows Firewall Disable via Netsh

OpenSSH Server Firewall Configuration on Windows - Firewall (via firewall-as)

Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)

Suspicious Firewall Rule Masquerading as CloudExperienceHost via netsh

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

Linux Syslog Alerts for Stopping Built-in Security Tools

Pivot detection · T1686 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-syslog-alert-for-stopping-security-tools-via-service-disruption-49f5dfc1

title: Linux Syslog Alerts for Stopping Built-in Security Tools
id: 46f18dca-9afc-4912-92b5-5464952fa384
related:
  - id: e3a8a052-111f-4606-9aee-f28ebeb76776
    type: derived
  - id: 49f5dfc1-f92e-4d34-96fa-feba3f6acf36
    type: derived
status: test
description: This rule flags syslog events containing keywords that indicate an attempt to stop built-in security components, such as stopping iptables/ip6tables, firewalld, cbdaemon, or falcon-sensor. Attackers may disable defensive tooling to reduce visibility and control system behavior. The detection relies on text-matching these stop-related phrases in Linux syslog telemetry.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml
author: Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-06-17
modified: 2022-11-26
tags:
  - attack.defense-impairment
  - attack.t1686
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - stopping iptables
    - stopping ip6tables
    - stopping firewalld
    - stopping cbdaemon
    - stopping falcon-sensor
  condition: keywords
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL