Unusual Windows System Service Disabled

[rule]
description = """
Identifies attempts to disable certain Windows security related services such as the Windows Defender or System Updates
via registry modification.
"""
id = "7c44cfc6-d336-400e-9cc1-2417dfb5c00a"
license = "Elastic License v2"
name = "Unusual Windows System Service Disabled"
os_list = ["windows"]
version = "1.0.13"

query = '''
registry where
 registry.value : "Start" and registry.data.strings == "4" and
 process.executable != null and registry.path != null and 
 registry.path :
         ("HKLM\\SYSTEM\\ControlSet001\\Services\\WinDefend\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\SecurityHealthService\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\Sense\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdBoot\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdFilter\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdNisDrv\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdNisSvc\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\wscsvc\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\EventLog\\Start") and
 not process.executable : ("?:\\Windows\\System32\\reg.exe", "?:\\Windows\\regedit.exe") and
 not (process.code_signature.subject_name in ("Connectwise, LLC", "Enestech Software (Cyprus) Ltd") and process.code_signature.trusted == true)
'''

actions = []
min_endpoint_version = "8.4.0"
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"