LoFP / network admin can delete services unit configuration file as part of normal software installation. filter is needed.

Techniques

• T1070
• T1070.004

Sample rules

Linux Indicator Removal Service File Deletion

• source: splunk
• technicques:
  • T1070.004
  • T1070

Description

This analytic looks for suspicious linux processes that delete service unit configuration files. This technique was seen in several malware to delete service configuration files to corrupt a services or security product as part of its defense evasion. This TTP detection can be a good indicator of possible malware try to kill several services or a wiper like AwfulShred shell script that wipes the targeted linux host

Detection logic

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "rm"  AND Processes.process = "*rm *"  AND Processes.process = "*.service" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `linux_indicator_removal_service_file_deletion_filter`