name: Attempt To Stop Security Service
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
version: 3
date: '2020-07-21'
author: Rico Valdez, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for attempts to stop security-related services on the
  endpoint.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
  where (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
  stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  |lookup security_services_lookup service as process OUTPUTNEW category, description
  | search category=security | `attempt_to_stop_security_service_filter`'
how_to_implement: You must be ingesting data that records the file-system activity
  from your hosts to populate the Endpoint file-system data-model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data. The search is shipped with a lookup file, `security_services.csv`,
  that can be edited to update the list of services to monitor. This lookup file can
  be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`,
  or via the Splunk console. You should add the names of services an attacker might
  use on the command line and surround with asterisks (*****), so that they work properly
  when searching the command line. The file should be updated with the names of any
  services you would like to monitor for attempts to stop the service.,
known_false_positives: None identified. Attempts to disable security-related services
  should be identified and understood.
references: []
tags:
  analytic_story:
  - Disabling Security Tools
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 5
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Installation
  - Actions on Objectives
  mitre_attack_id:
  - T1562.001
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.user
  security_domain: endpoint
