splunk-security_content/docs/_stories/disabling_security_tools.md

title, last_modified_at, toc, tags

title	last_modified_at	toc	tags
Disabling Security Tools	2020-02-04	true	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Description

Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious reg.exe processes, processes launching netsh, and many others.

• ID: fcc27099-46a0-46b0-a271-5c7dab56b6f1
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2020-02-04
• Author: Rico Valdez, Splunk

Detection profiles

Name	Technique	Type
Attempt To Add Certificate To Untrusted Store	None	TTP
Attempt To Stop Security Service	None	TTP
Processes launching netsh	None	TTP
Sc exe Manipulating Windows Services	None	TTP
Suspicious Reg exe Process	None	TTP
Unload Sysmon Filter Driver	None	TTP

Reference

• https://attack.mitre.org/wiki/Technique/T1089
• https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/
• https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf

source | version: 2