mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
name: Sc exe Manipulating Windows Services
|
|
id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
|
|
version: 4
|
|
date: '2020-07-21'
|
|
description: This search looks for arguments to sc.exe indicating the creation or
|
|
modification of a Windows service.
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
|
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
|
where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="*
|
|
config *") by Processes.process_name Processes.parent_process_name Processes.dest
|
|
Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`'
|
|
known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
|
|
there may be legitimate instances of this behavior. It is important to validate
|
|
and investigate as appropriate.
|
|
tags:
|
|
analytics_story:
|
|
- Windows Service Abuse
|
|
- DHS Report TA18-074A
|
|
- Orangeworm Attack Group
|
|
- Windows Persistence Techniques
|
|
- Disabling Security Tools
|
|
mitre_attack_id:
|
|
- T1543.003
|
|
kill_chain_phases:
|
|
- Installation
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 8
|
|
nist:
|
|
- PR.IP
|
|
- PR.PT
|
|
- PR.AC
|
|
- PR.AT
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|