Detection of Service Termination via Linux Auditd

Adversaries often target critical system services on Linux platforms to disable defensive mechanisms, facilitate privilege escalation, or prepare for destructive operations. The monitoring of the Linux Auditd SERVICE_STOP event type provides visibility into these attempts. This activity was explicitly noted in campaigns involving malware like Industroyer2 and AwfulShred, where attackers sought to neutralize host-based security controls before deploying payloads. Defending against this behavior is critical for maintaining system integrity and operational availability. Detection engineering teams should baseline legitimate administrative service management activity to reduce noise, as service control is a frequent task for system administrators and automation scripts.

Impact

Successful termination of security or operational services can lead to total loss of host visibility, bypass of endpoint detection and response (EDR) agents, privilege escalation, and the subsequent deployment of destructive payloads. This technique has been observed in high-impact campaigns targeting critical infrastructure, aiming to disable services that monitor system health or log security-relevant events.

Recommendation

• Ingest Auditd logs (specifically SYSCALL, TYPE, EXECVE, and PROCTITLE events) into your SIEM and ensure they are parsed according to the Common Information Model (CIM).
• Deploy detection logic targeting Auditd SERVICE_STOP events, particularly those initiated by non-administrative user contexts.
• Baseline the comm and exe fields associated with service management in your environment to distinguish between legitimate operator activity and potential adversary activity.
• Monitor for service termination events originating from unexpected processes, specifically those not associated with systemd or recognized administration tools.