From e0e83fc2667be68446e8bedcae06e2b4b2aebcea Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Apr 2022 09:49:00 +0200 Subject: [PATCH 1/2] service_name_added --- .../endpoint/windows_event_for_service_disabled.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 005e34defa..79769a4844 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -10,10 +10,11 @@ description: This analytic will identify suspicious system event of services tha was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host -search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from - demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`' +search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_event_for_service_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. From 6a4b0b258195135e2d99a4e8b6ec8ff52ccb70d1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 4 Apr 2022 09:50:56 +0200 Subject: [PATCH 2/2] service_name_added --- detections/endpoint/windows_event_for_service_disabled.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 79769a4844..c8a0681241 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -1,7 +1,7 @@ name: Windows Event For Service Disabled id: 9c2620a8-94a1-11ec-b40c-acde48001122 -version: 1 -date: '2022-02-23' +version: 2 +date: '2022-04-04' author: Teoderick Contreras, Splunk type: Hunting datamodel: