From 84b8fd673299c54bd31e206ce02c8981a511ea6b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 19 May 2021 06:59:04 -0600 Subject: [PATCH] Update excessive_service_stop_attempt.yml --- detections/endpoint/excessive_service_stop_attempt.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 349826f75e..90a3b86d5a 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious series of attempt to kill multiple - services in a machine using either net.exe or sc.exe. This technique is use by adversaries - to kill security services or other related services to continue there attack and +description: This analytic identifies suspicious series of attempt to kill multiple + services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries + to terminate security services or other related services to continue there objective and evade detections. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)