Rule Info
Name
Linux Security Control Disabling Attempt
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects attempts to forcefully kill Linux mandatory access control frameworks.
Attackers commonly terminate these security services as a post-exploitation step
to reduce visibility and weaken host defences before lateral movement or data exfiltration.
Date
2026-10-02 00:00:00
Modified
None
Id
d3522f63-57d1-44ae-af92-5a9172cc6fb0
Tags
attack.defense-impairment attack.t1685
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR