Detection rules › Sigma

Massive services termination burst

Status
experimental
Severity
high
Time window
1m
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to stop multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

MITRE ATT&CK coverage

TacticTechniques
ImpactT1489 Service Stop

Event coverage

Rule body yaml

title: Massive services termination burst
description: Detects scenarios where an attacker attempts to stop multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
references:
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
- https://fourcore.io/blogs/ryuk-ransomware-simulation-mitre-ttp
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
- https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
tags:
- attack.impact
- attack.t1489 # Service Stop 
- attack.defense_evasion
- attack.1562.001 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # net stop <service> | sc stop <service>
  selection_net_stop:  
    NewProcessName|endswith:
      - '\net1.exe'
      - '\net.exe'
    CommandLine|contains|all:
      - net
      - stop
  
  selection_sc_stop:
    NewProcessName|endswith: '\sc.exe'
    CommandLine|contains|all:
      - sc
      - stop

  condition: selection_net_stop or selection_sc_stop | count(EventRecordID) by Computer > 2
  timeframe: 1m
falsepositives:
- Administrator debugging
level: high

Stages and Predicates

Stage 0: condition

selection_net_stop or selection_sc_stop | count(EventRecordID) by Computer > 2

Stage 1: selection_net_stop

selection_net_stop:
  NewProcessName|endswith:
    - '\net1.exe'
    - '\net.exe'
  CommandLine|contains|all:
    - net
    - stop
Threshold
> 2

Stage 2: selection_sc_stop

selection_sc_stop:
  NewProcessName|endswith: '\sc.exe'
  CommandLine|contains|all:
    - sc
    - stop

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • net corpus 7 (sigma 7)
  • sc corpus 6 (sigma 6)
  • stop corpus 7 (sigma 5, splunk 2)
NewProcessNameends_with
  • \net.exe corpus 49 (sigma 49)
  • \net1.exe corpus 47 (sigma 47)
  • \sc.exe corpus 30 (sigma 30)