Service Stop Commands (Windows Event Log)

id: '5367.5470'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=4656 OR EventCode=4688
  OR "EventID>4688<" OR "EventID>4656<") ((TERM(sc.exe) OR TERM(sc) OR TERM(net) OR
  TERM(net.exe) ) AND TERM(stop) AND (TERM(ShellHWDetection) OR TERM(AVPSUS) OR TERM(McAfeeDLPAgentService)
  OR TERM(mfewc) OR TERM(eventlog) OR (TERM(BMR) AND TERM(SERVICE)))) OR ( TERM(taskkill)
  AND ( TERM(/IM) OR TERM(/PID) OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc))
  AND TERM(CONFIG) AND TERM(START=) AND TERM(DISABLED)) | eval process2=mvappend(Object_Server,
  Accesses, Object_Name), process=mvappend(process,process2) | regex process="(?i)(stop.*(ShellHWDetection|AVPSUS|McAfeeDLPAgentService|mfewc|eventlog|BMR.*service))|(taskkill)|(start=.*disabled)"
  | table _time, host, user event_id, parent_process, parent_process_id, parent_process_name,
  parent_process_path, process, process_current_directory, process_id, process_name,
  process_path, signature_id, user_id | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf