From d9c8e1092036c8a374d5115c3ad65368fb7eaf3d Mon Sep 17 00:00:00 2001 From: Michael Hart Date: Mon, 28 Jun 2021 14:14:42 -0400 Subject: [PATCH] Slight correction. Process contains cmd line arguments for finding distinct number of sc invocations. Removing this and process id from BY clause --- ...xcessive_number_of_service_control_start_as_disabled.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index d17ebf885d..41a2b336b0 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -13,10 +13,10 @@ description: This detection targets behaviors observed when threat actors have u we see both an excessive number of sc.exe processes launched with specific commandline arguments to disable the start of certain services. search: '| tstats `security_content_summariesonly` distinct_count(Processes.process) - as distinct_cmdlines min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process - Processes.process_id Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8 + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id, + _time span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`' how_to_implement: You must be ingesting data that records process activity from your