mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
54 lines
2.5 KiB
JSON
54 lines
2.5 KiB
JSON
{
|
|
"category": "Adversary Tactics",
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-04-09",
|
|
"description": "Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious <code>reg.exe</code> processes, processes launching netsh, and many others.",
|
|
"id": "fcc27099-46a0-46b0-a271-5c7dab56b6f1",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"modification_date": "2018-04-09",
|
|
"name": "Disabling Security Tools",
|
|
"narrative": "Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a blacklist (which would prevent them from running).",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://attack.mitre.org/wiki/Technique/T1089",
|
|
"https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/",
|
|
"https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Sc.exe Manipulating Windows Services",
|
|
"Suspicious Reg.exe Process",
|
|
"Processes launching netsh",
|
|
"Attempt To Stop Security Service",
|
|
"Attempt To Add Certificate To Untrusted Store"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Parent Process Info"
|
|
],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|