Rule Info
Name
Logging Daemon Force Killed via CommandLine
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects use of kill, killall, pkill, or other command line methods to forcefully terminate
common Linux logging and auditing services. Threat actors or malware may use this technique
to silence audit trails before encryption or exfiltration.
Date
2026-08-19 00:00:00
Modified
None
Id
7c4e2f1a-8b3d-4a9e-b2c5-1f6e0d3a7c8b
Tags
attack.defense-impairment attack.t1685.004
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR