From 9211481e2bcf7e5de9de1874f9efdc3033ddb06d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Sep 2021 19:28:19 +0000 Subject: [PATCH] Added detection testing service results inAttempt To Stop Security Service --- .../attempt_to_stop_security_service.yml | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 7685b114c8..8dfea2057d 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -10,13 +10,17 @@ description: This search looks for attempts to stop security-related services on endpoint. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` OR Processes.process_name = sc.exe Processes.process="* - stop *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup - security_services_lookup service as process OUTPUTNEW category, description | search - category=security | `attempt_to_stop_security_service_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop + *" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + |lookup security_services_lookup service as process OUTPUTNEW category, description + | search category=security | `attempt_to_stop_security_service_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. references: @@ -36,7 +40,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log impact: 40 kill_chain_phases: - Installation @@ -74,11 +78,11 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process_name #parent process name - - Processes.parent_process #parent cmdline + - Processes.parent_process_name + - Processes.parent_process - Processes.original_file_name - - Processes.process_name #process name - - Processes.process #process cmdline + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_path - Processes.process_path