BIOC
Informational
✕
Security services stopped
Attackers may stop security critical services to avoid possible detection of their activities.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Tampering
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
Indicator:
Process action type = execution AND target process name = service , systemctl AND target process cmd = *stop*iptables* , *iptables*stop* , *firewalld*stop* , *stop*firewalld* , *stop*rsyslog* , *rsyslog*stop* , *stop*cbdaemon* , *cbdaemon*stop* , *disable*rsyslog* , *rsyslog*disable* , *stop*falcon-sensor* , *falcon-sensor*stop* , *falcon-sensor*disable* , *disable*falcon-sensor* Host host os = linux
Preventable: yes