Techniques › T1668 › AN0046
AN0046 Analytic 0046
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary attempts to monopolize control of compromised systems by issuing service stop commands, unloading vulnerable modules, or forcefully killing competing processes. Defenders should monitor audit logs and syslog for administrative utilities (systemctl, service, kill) being invoked outside of normal change management.</p>
- Detects
- T1668 Exclusive Control
- Part of
- DET0015 Detection Strategy for Exclusive Control
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Commands like systemctl stop <service>, service <service> stop, or kill -9 <pid> | DC0064 Command Execution |
| linux:syslog | Unexpected termination of daemons or critical services not aligned with admin change tickets | DC0033 Process Termination |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CriticalProcessList | Defines specific Linux daemons and processes that should not be terminated outside maintenance windows. |
AdminUserContext | Defines expected accounts permitted to execute service stop commands; deviations may be suspicious. |