mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
91 lines
3.7 KiB
JSON
91 lines
3.7 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, process, user",
|
|
"rule_description": "Attempt to stop a security-related service on $dest$",
|
|
"rule_title": "Attempt to Stop Security Service On $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "src",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 50
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, user",
|
|
"suppress_period": "86400s"
|
|
}
|
|
},
|
|
"creation_date": "2018-04-09",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon",
|
|
"Tanium",
|
|
"Ziften"
|
|
]
|
|
},
|
|
"eli5": "This search looks for the processes <b>net.exe</b> and <b>sc.exe</b> with a parameter of <code>\"stop\"</code>. It then searches a list of security-related services included in a lookup file for matches on the command line. Results are subsequently returned in table format. The included lookup file can be modified to update the services to monitor.",
|
|
"how_to_implement": "You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. The search is shipped with a lookup file, <code>security_services.csv</code>, that can be edited to update the list of services to monitor. This lookup file can be edited directly where it lives in <code>$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups</code>, or via the Splunk console. You should add the names of services an attacker might use on the command line and surround with asterisks (<b>*</b>), so that they work properly when searching the command line. The file should be updated with the names of any services you would like to monitor for attempts to stop the service.,",
|
|
"known_false_positives": "None identified. Attempts to disable security-related services should be identified and understood.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5",
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Installation",
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Defense Evasion",
|
|
"Disabling Security Tools"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM",
|
|
"PR.IP"
|
|
]
|
|
},
|
|
"modification_date": "2017-09-15",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process=\"* stop *\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security",
|
|
"search_description": "This search looks for attempts to stop security-related services on the endpoint.",
|
|
"search_id": "c8e349c6-b97c-486e-8949-bd7bcd1f3910",
|
|
"search_name": "Attempt To Stop Security Service",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "2.0"
|
|
}
|