splunk-security_content/docs/_posts/2021-11-24-attempt_to_delete_services.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Attempt To Delete Services	Service Stop, Create or Modify System Process, Windows Service	Endpoint	2021-11-24	true		Service Stop Impact Create or Modify System Process Persistence Privilege Escalation Windows Service Persistence Privilege Escalation Splunk Behavioral Analytics Endpoint_Processes

Try in Splunk Security Cloud{: .btn .btn--success}

Description

The following analytic identifies Windows Service Control, sc.exe, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.

• Type: TTP
• Product: Splunk Behavioral Analytics
• Datamodel: Endpoint_Processes
• Last Updated: 2021-11-24
• Author: Teoderick Contreras, splunk
• ID: a0c8c292-d01a-11eb-aa18-acde48001122

ATT&CK

ID	Technique	Tactic
T1489	Service Stop	Impact

| T1543 | Create or Modify System Process | Persistence, Privilege Escalation |

| T1543.003 | Windows Service | Persistence, Privilege Escalation |

Search

| from read_ssa_enriched_events() 
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
| where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe" 
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) 
| into write_ssa_detected_events();

Associated Analytic Story

• XMRig
• Ransomware

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

• _time
• dest_device_id
• process_name
• parent_process_name
• process_path
• dest_user_id
• process
• cmd_line

Kill Chain Phase

• Exploitation

Known False Positives

It is possible administrative scripts may start/stop/delete services. Filter as needed.

RBA

Risk Score	Impact	Confidence	Message
36.0	60	60	An instance of parent_process_name spawning process_name was identified on endpoint dest_device_id by user dest_user_id attempting to delete a service.

Reference

• https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log

source | version: 3