Try in Splunk Security Cloud

Description

This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly to block others from compromising the same machine. This detection will alert when we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services.

  • Type: Anomaly
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2021-06-25
  • Author: Michael Hart, Splunk
  • ID: 77592bec-d5cc-11eb-9e60-acde48001122

ATT&CK

ID Technique Tactic
T1562.001 Disable or Modify Tools Defense Evasion
T1562 Impair Defenses Defense Evasion

| tstats `security_content_summariesonly` distinct_count(Processes.process) as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, _time span=30m 
| where distinct_cmdlines >= 8 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `excessive_number_of_service_control_start_as_disabled_filter`

Associated Analytic Story

How To Implement

You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

  • _time
  • Processes.dest
  • Processes.user
  • Processes.parent_process
  • Processes.process_name
  • Processes.process
  • Processes.process_id
  • Processes.parent_process_id

Kill Chain Phase

  • Exploitation

Known False Positives

Legitimate programs and administrators will execute sc.exe with the start disabled flag. It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time.

RBA

Risk Score Impact Confidence Message
80.0 80 100 An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1