Service Stop Commands

Group by: _time, host, unit
Source: github.com/anvilogic-forge/armory

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools
Impact	`T1489` Service Stop

References

Telemetry coverage

Platform	Record / event type
Linux	auditd SERVICE_STOP record: Service (daemon) stop

Rule body

id: '5367.9863'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` (("systemctl" OR "service") "stop")
  OR (type=service_stop TERM(success)) | table _time, host, user process, process_*,
  type, unit | bin span=1s | stats values(*) as * by _time, host | eventstats dc(host)
  as dc_host c(unit) as c_unit by unit| where match(process, "(?i)(systemctl|service)\s.*?stop")
  OR (match(type, "(?i)(service_stop)") AND dc_host < 3 AND c_unit < 10) '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Linux audit logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_unix` (("systemctl" OR "service") "stop") OR (type=service_stop TERM(success))

Stage 2: `table`

| table _time, host, user process, process_*, type, unit

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `eventstats`

| eventstats dc(host) as dc_host c(unit) as c_unit by unit

Stage 6: `where`

| where match(process, "(?i)(systemctl|service)\s.*?stop") OR (match(type, "(?i)(service_stop)") AND dc_host < 3 AND c_unit < 10)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c_unit`	lt	`10`	`field:"c_unit" kind:lt value:"10"`
`dc_host`	lt	`3`	`field:"dc_host" kind:lt value:"3"`
`process`	regex_match	`"(?i)(systemctl\|service)\s.*?stop"`	`field:"CommandLine" kind:regex_match`
`type`	eq	`service_stop`	`field:"type" kind:eq value:"service_stop"`
`type`	regex_match	`"(?i)(service_stop)"`	`field:"type" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"systemctl"`
1	`"service"`
1	`"stop"`
1	`success`