admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

service_name_added

Browse Source
This commit is contained in:
tccontre
2022-04-04 09:49:00 +02:00
parent 26081e479e
commit e0e83fc266
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_event_for_service_disabled.yml
+5 -4
View File
@@ -10,10 +10,11 @@ description: This analytic will identify suspicious system event of services tha
was modified from start to disabled. This technique is seen where the adversary
attempts to disable security app services, other malware services to evade the defense
systems on the compromised host
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled."
| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_event_for_service_disabled_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.