Service deactivation (command)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to disable

Known false positives

troubleshooting

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Service deactivation (command)
description: Detects scenarios where an attacker attempts to disable 
references:
- https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
tags:
- attack.impact
- attack.t1489 # Service Stop 
- attack.defense_evasion
- attack.1562.001 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\sc.exe'
    CommandLine|contains|all:
      - sc
      - config
      - disabled
  condition: selection
falsepositives:
- troubleshooting
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  NewProcessName|endswith: '\sc.exe'
  CommandLine|contains|all:
    - sc
    - config
    - disabled

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`config` corpus 16 (sigma 15, splunk 1) `disabled` corpus 7 (sigma 5, elastic 1, splunk 1) `sc` corpus 6 (sigma 6)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\sc.exe` corpus 30 (sigma 30)	`field:"Image" kind:ends_with value:"\sc.exe"`

Service deactivation (command)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`