Attempt to Disable Syslog Service

Benjamin Zulliger@benscha

•updated Feb 26, 2026•10•0•111

Detects attempts to disable or stop syslog services (syslog, rsyslog, syslog-ng) using common system utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses by preventing logging of their actions.