app-armor-stopped

Description

This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency. The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.

Query · kql

DeviceProcessEvents
| where InitiatingProcessCommandLine  has "/bin/bash /tmp/" and ProcessCommandLine has "service apparmor stop"
Raw source app-armor-stopped · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a188fa21-dd3a-4cf9-910b-1384711f7dce
name: app-armor-stopped
description: |
  This query was originally published in the threat analytics report, Sysrv botnet evolution.
  Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
  The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where InitiatingProcessCommandLine  has "/bin/bash /tmp/" and ProcessCommandLine has "service apparmor stop"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.