mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
47 lines
2.1 KiB
YAML
47 lines
2.1 KiB
YAML
name: Attempt To Stop Security Service
|
|
id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
|
|
version: 3
|
|
date: '2020-07-21'
|
|
description: This search looks for attempts to stop security-related services on the
|
|
endpoint.
|
|
how_to_implement: You must be ingesting data that records the file-system activity
|
|
from your hosts to populate the Endpoint file-system data-model node. If you are
|
|
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
|
you want to collect data. The search is shipped with a lookup file, `security_services.csv`,
|
|
that can be edited to update the list of services to monitor. This lookup file can
|
|
be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`,
|
|
or via the Splunk console. You should add the names of services an attacker might
|
|
use on the command line and surround with asterisks (*****), so that they work properly
|
|
when searching the command line. The file should be updated with the names of any
|
|
services you would like to monitor for attempts to stop the service.,
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
|
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
|
where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="*
|
|
stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
|
|
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
|
|lookup security_services_lookup service as process OUTPUTNEW category, description
|
|
| search category=security | `attempt_to_stop_security_service_filter`'
|
|
known_false_positives: None identified. Attempts to disable security-related services
|
|
should be identified and understood.
|
|
tags:
|
|
analytics_story:
|
|
- Disabling Security Tools
|
|
mitre_attack_id:
|
|
- T1562.001
|
|
kill_chain_phases:
|
|
- Installation
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 8
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
- PR.IP
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|