Inhibit System Recovery via Stopping Backup Services

[rule]
description = """
Identifies the execution of Windows utilities to tamper with Data Backup related services. Adversaries may delete or
remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and
prevent recovery.
"""
id = "220ab556-e008-44d4-9c50-44d455225eee"
license = "Elastic License v2"
name = "Inhibit System Recovery via Stopping Backup Services"
os_list = ["windows"]
version = "1.0.26"

query = '''
sequence with maxspan=1m
 [process where event.action == "start" and
  (
  (process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Python*") and
   not process.code_signature.trusted == true) or
   process.name : ("rundll32.exe", "regsvr32.exe", "cscript.exe", "wscript.exe", "java*.exe", "powershell.exe", "cmd.exe")
   ) and

   not process.parent.command_line: ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
   not process.parent.executable :
                ("?:\\Windows\\System32\\svchost.exe",
                 "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
                 "?:\\Windows\\Microsoft.NET\\Framework\\*\\InstallUtil.exe",
                 "?:\\Windows\\System32\\taskeng.exe",
                 "?:\\Program Files\\Symantec\\Backup Exec\\RAWS\\VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\Veritas\\Backup Exec\\RAWS\\VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\Veritas\\Veritas VSS Provider\\bevssrequestor.exe",
                 "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
                 "?:\\Program Files\\Rubrik\\Rubrik Backup Service\\rba.exe") and
   process.parent.executable != null and
   not (process.name : "cmd.exe" and
        process.args : ("?:\\Users\\*\\AppData\\Local\\Temp\\rubrik_vmware*\\uninstall-provider.cmd",
                        "Master\\DC\\bin\\x64\\*-EaseUSprovider.cmd",
                        "Files\\QNAP\\VSS")) and
   not (process.parent.name : "powershell.exe" and process.parent.args : "Start-Process .\\Stores\\Files\\restartSqlServer.bat -Verb RunAs")
 ] by process.entity_id
 [process where event.action == "start" and
  process.pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and
  process.args : ("stop", "disabled") and
  process.args :
     ("SamSss", "VSS", "SDRSVC", "wbengine", "GoogleVssAgent", "SstpSvc", "sacsvr", "vmicvss", "SQLWriter", "SQLTELEMETRY*", 
      "VeeamNFSSvc*", "VeeamTransportSvc*", "acronis*", "*backup*", "iisadmin", "veeamtransportsvc", "MSSQL*", "SQLSERVER*",
      "dosvc", "MongoDB", "Oracle*", "NFSysService", "SentinelKeysServer", "DellDRLogSvc", "TPlusStd*", "TurboCRM70", "U8*Service") and

  not (process.args : "vss" and process.parent.args : ("?:\\Windows\\TEMP\\rubrik_vmware*", "Agent\\InMageVSSProvider_Install.cmd"))
 ] by process.parent.entity_id
 [process where event.action == "start" and
  process.pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and
  process.args : ("stop", "disabled") and
  process.args :
     ("SamSss", "VSS", "SDRSVC", "wbengine", "GoogleVssAgent", "SstpSvc", "sacsvr", "vmicvss", "SQLWriter", "SQLTELEMETRY*",
      "VeeamNFSSvc*", "VeeamTransportSvc*", "acronis*", "*backup*", "iisadmin", "veeamtransportsvc", "MSSQL*", "SQLSERVER*",
      "dosvc", "MongoDB", "Oracle*", "NFSysService", "SentinelKeysServer", "DellDRLogSvc", "TPlusStd*", "TurboCRM70", "U8*Service") and

  not (process.args : "vss" and process.parent.args : ("?:\\Windows\\TEMP\\rubrik_vmware*", "Agent\\InMageVSSProvider_Install.cmd"))
 ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"