Massive services deletion burst

Status: experimental
Severity: high
Time window: 1m
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Known false positives

Product uninstallation

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Massive services deletion burst
description: Detects scenarios where an attacker attempts to delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
references:
- https://unit42.paloaltonetworks.com/mallox-ransomware/
tags:
- attack.impact
- attack.t1489 # Service Stop 
- attack.defense_evasion
- attack.1562.001 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\sc.exe'
    CommandLine|contains: delete
  condition: selection | count(EventRecordID) by Computer > 2
  timeframe: 1m
falsepositives:
- Product uninstallation
level: high

Stages and Predicates

Stage 0: `condition`

selection | count(EventRecordID) by Computer > 2

Stage 1: `selection`

selection:
  NewProcessName|endswith: '\sc.exe'
  CommandLine|contains: delete

Threshold: > 2

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`delete` corpus 31 (sigma 16, elastic 8, splunk 6, kusto 1)	`field:"CommandLine" kind:match value:"delete"`
`NewProcessName`	ends_with	`\sc.exe` corpus 30 (sigma 30)	`field:"Image" kind:ends_with value:"\sc.exe"`