admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-04-04 04:15:08 -07:00
committed by GitHub
parent 172e06ad6c 1d1ffe6c74
commit f89e4664e1
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_event_for_service_disabled.yml
+7 -6
View File
@@ -1,7 +1,7 @@
name: Windows Event For Service Disabled
id: 9c2620a8-94a1-11ec-b40c-acde48001122
version: 1
date: '2022-02-23'
version: 2
date: '2022-04-04'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
@@ -10,10 +10,11 @@ description: This analytic will identify suspicious system event of services tha
was modified from start to disabled. This technique is seen where the adversary
attempts to disable security app services, other malware services to evade the defense
systems on the compromised host
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled."
| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_event_for_service_disabled_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.