Skip to content
Threat Feed
medium advisory

Linux Service Stop and Disable Detection

Attackers may halt or disable security services on Linux systems to evade defenses, maintain persistence, or disrupt operations, detected through the use of utilities like 'systemctl', 'service', and 'chkconfig'.

Attackers may attempt to stop or disable services on a compromised Linux system to impair security tools, disrupt operations, or facilitate further malicious activities. This can involve disabling security software, logging mechanisms, or other critical services that could hinder the attacker’s objectives. This activity often forms part of a broader attack campaign aimed at maintaining persistence, evading detection, or causing system-wide disruption. The commands systemctl, service, and…

Detection coverage 3

Detect Systemctl Service Stop or Disable

medium

Detects the use of systemctl to stop or disable services on Linux systems, potentially indicating an attempt to evade defenses or disrupt operations.

sigma tactics: defense-evasion, impact techniques: T1489, T1562 sources: process_creation, linux

Detect Service Command Stop or Disable

medium

Detects the use of the 'service' command to stop or disable services, indicative of potential malicious activity.

sigma tactics: defense-evasion, impact techniques: T1489, T1562 sources: process_creation, linux

Detect Chkconfig Service Manipulation

medium

Detects the usage of chkconfig to disable services, often used for persistence or defense evasion.

sigma tactics: defense-evasion, persistence techniques: T1562 sources: process_creation, linux

Detection queries are kept inside the platform. Get full rules →