Suspicious Disabling Security Utilities - Builtin (via syslog)

title: Suspicious Disabling Security Utilities - Builtin (via syslog)
id: 719f5fd4-4504-5b66-8e84-f73830a970f5
status: stable
description: This rule detects disabling security tools
references:
    - https://attack.mitre.org/techniques/T1686/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
author: Huntrule Team
date: 2026-05-25
tags:
    - attack.defense-impairment
    - attack.t1686
logsource:
    product: linux
    service: syslog
detection:
    keywords:
        - 'stopping iptables'
        - 'stopping ip6tables'
        - 'stopping firewalld'
        - 'stopping cbdaemon'
        - 'stopping falcon-sensor'
    condition: keywords
falsepositives:
    - Unknown
level: medium