Logging Service Stopped via Service Command

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects use of the legacy service command to stop common Linux logging and auditing services. The service command wraps SysV init scripts and remains functional on systemd-based distributions via compatibility shims. Attackers use this to stop logging with a command that blends into older administration patterns.

2026-08-19 00:00:00

None

9b2e4f3a-1c5d-4b8e-a7c6-5d3f2e0b1a4c

attack.defense-impairment attack.t1685.004

Nextron Sigma feed only (private)