mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
55 lines
2.4 KiB
YAML
55 lines
2.4 KiB
YAML
category:
|
|
- Adversary Tactics
|
|
channel: ESCU
|
|
creation_date: '2018-04-09'
|
|
description: Looks for activities and techniques associated with the disabling of
|
|
security tools on a Windows system, such as suspicious `reg.exe` processes, processes
|
|
launching netsh, and many others.
|
|
detections:
|
|
- detection_id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
|
|
name: Sc.exe Manipulating Windows Services
|
|
type: splunk
|
|
- detection_id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
|
|
name: Suspicious Reg.exe Process
|
|
type: splunk
|
|
- detection_id: b89919ed-fe5f-492c-b139-95dbb162040e
|
|
name: Processes launching netsh
|
|
type: splunk
|
|
- detection_id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
|
|
name: Attempt To Stop Security Service
|
|
type: splunk
|
|
- detection_id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
|
|
name: Attempt To Add Certificate To Untrusted Store
|
|
type: splunk
|
|
- detection_id: c77162d3-f93c-45cc-80c8-22f665664g9f
|
|
name: Unload Sysmon Filter Driver
|
|
type: splunk
|
|
id: fcc27099-46a0-46b0-a271-5c7dab56b6f1
|
|
maintainers:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
modification_date: '2020-02-04'
|
|
name: Disabling Security Tools
|
|
narrative: Attackers employ a variety of tactics in order to avoid detection and operate
|
|
without barriers. This often involves modifying the configuration of security tools
|
|
to get around them or explicitly disabling them to prevent them from running. This
|
|
Analytic Story includes searches that look for activity consistent with attackers
|
|
attempting to disable various security mechanisms. Such activity may involve monitoring
|
|
for suspicious registry activity, as this is where much of the configuration for
|
|
Windows and various other programs reside, or explicitly attempting to shut down
|
|
security-related services. Other times, attackers attempt various tricks to prevent
|
|
specific programs from running, such as adding the certificates with which the security
|
|
tools are signed to a blacklist (which would prevent them from running).
|
|
original_authors:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
references:
|
|
- https://attack.mitre.org/wiki/Technique/T1089
|
|
- https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/
|
|
- https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf
|
|
spec_version: 2
|
|
usecase: Security Monitoring
|
|
version: '2.0'
|