ID | Technique | Tactic |
---|---|---|
T1562.001 | Disable or Modify Tools | Defense Evasion |
T1562 | Impair Defenses | Defense Evasion |
Detection: Windows Event For Service Disabled
Description
The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
Search
1`wineventlog_system` EventCode=7040 EventData_Xml="*disabled*"
2| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode Name UserID service ServiceName
3| rename Computer as dest
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `windows_event_for_service_disabled_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Windows Event Log System 7040 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:System' |
N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
windows_event_for_service_disabled_filter | search * |
windows_event_for_service_disabled_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | False |
Implementation
To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
Known False Positives
Windows service update may cause this event. In that scenario, filtering is needed.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Service $ServiceName$ was disabled on $dest$ | 36 | 60 | 60 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:System |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:System |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 4