Detection: Windows Attempt To Stop Security Service

Description

The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response.

Search

 1
 2| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
 3  WHERE (
 4        (`process_net`
 5        OR
 6        `process_sc`) Processes.process="* stop *"
 7    )
 8    OR Processes.process="*Stop-Service *"
 9  BY Processes.action Processes.dest Processes.original_file_name
10     Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
11     Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
12     Processes.process Processes.process_exec Processes.process_guid
13     Processes.process_hash Processes.process_id Processes.process_integrity_level
14     Processes.process_name Processes.process_path Processes.user
15     Processes.user_id Processes.vendor_product
16
17| `drop_dm_object_name(Processes)`
18
19| `security_content_ctime(firstTime)`
20
21| `security_content_ctime(lastTime)`
22
23| lookup security_services_lookup service as process OUTPUTNEW category, description
24
25| search category=security
26
27| `windows_attempt_to_stop_security_service_filter`

Data Source

Name	Platform	Sourcetype	Source
CrowdStrike ProcessRollup2	Other	'crowdstrike:events:sensor'	'crowdstrike'
Sysmon EventID 1	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'
Windows Event Log Security 4688	Windows	'XmlWinEventLog'	'XmlWinEventLog:Security'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

No false positives have been identified at this time. should be identified and understood.

Associated Analytic Story

• Azorult

• Data Destruction

• Disabling Security Tools

• Graceful Wipe Out Attack

• Trickbot

• WhisperGate

Risk Based Analytics (RBA)

Risk Message:

An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.

References

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 7