Disabling Security Tools - Builtin

Title: Disabling Security Tools - Builtin
Status: test
Description:Detects disabling security tools
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
Author: Ömer Günal, Alejandro Ortuno, oscd.community
Date: 2020-06-17
modified:2022-11-26
Tags:

• -'attack.defense-impairment'
• -'attack.t1686'

Logsource:

• product: linux
• service: syslog

Detection:
  keywords:
    - 'stopping iptables'
    - 'stopping ip6tables'
    - 'stopping firewalld'
    - 'stopping cbdaemon'
    - 'stopping falcon-sensor'
  condition:keywords
Falsepositives:
  -Legitimate administration activities
Level: medium