splunk-security_content/detections/stop_security_services.yml

asset_type: Endpoint
confidence: high
creation_date: '2018-04-09'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: This search looks for attempts to stop security-related services on the
  endpoint.
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, process, user
        rule_description: Attempt to stop a security-related service on $dest$
        rule_title: Attempt to Stop Security Service On $dest$
      risk:
        risk_object: src
        risk_object_type:
          - system
        risk_score: 50
      schedule:
        cron_schedule: 0 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time)
        as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
        (Processes.process_name = net.exe OR  Processes.process_name = sc.exe) Processes.process="*
        stop *" by Processes.process_name Processes.parent_process_name Processes.dest
        Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
        |lookup security_services_lookup service as process OUTPUTNEW category, description
        | search category=security'
      suppress:
        suppress_fields: dest, user
        suppress_period: 86400s
eli5: This search looks for the processes **net.exe** and **sc.exe** with a parameter
  of `"stop"`. It then searches a list of security-related services included in a
  lookup file for matches on the command line. Results are subsequently returned in
  table format. The included lookup file can be modified to update the services to
  monitor.
entities:
  - src
how_to_implement: You must be ingesting data that records the file-system activity
  from your hosts to populate the Endpoint file-system data-model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data. The search is shipped with a lookup file, `security_services.csv`,
  that can be edited to update the list of services to monitor. This lookup file can
  be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`,
  or via the Splunk console. You should add the names of services an attacker might
  use on the command line and surround with asterisks (*****), so that they work properly
  when searching the command line. The file should be updated with the names of any
  services you would like to monitor for attempts to stop the service.,
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
investigations:
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fecf2918-670d-4f1c-872b-3d7317a41bf9
    name: Get Parent Process Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
    name: Get Process Info
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
known_false_positives: None identified. Attempts to disable security-related services
  should be identified and understood.
maintainers:
  - company: Splunk
    email: rvaldez@splunk.com
    name: Rico Valdez
mappings:
  cis20:
    - CIS 3
    - CIS 5
    - CIS 8
  kill_chain_phases:
    - Installation
    - Actions on Objectives
  mitre_attack:
    - Defense Evasion
    - Disabling Security Tools
  nist:
    - PR.PT
    - DE.CM
    - PR.IP
modification_date: '2017-09-15'
name: Attempt To Stop Security Service
original_authors:
  - company: Splunk
    email: rvaldez@splunk.com
    name: Rico Valdez
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'