Disabling Security Tools on Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•23

This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.