Elastic Defend high stable eql

Attempt to Disable Windows Defender Services

Identifies attempt to stop or disable the Windows Defender services from an unusual parent process.

View Source

Detection Logic

process where event.action == "start" and
  process.pe.original_file_name : ("net.exe", "sc.exe", "cmd.exe") and
  process.command_line : ("*disabled*", "*stop*") and process.command_line : ("*WdNisSvc*", "*WinDefend*") and
    (process.parent.executable :
                    ("?:\\Windows\\Microsoft.NET\\*",
                     "?:\\Users\\*",
                     "?:\\ProgramData\\*") or
    process.parent.name : ("rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "powershell.exe", "mshta.exe"))

Field Validations

Loading…

Comments (0)

Loading comments...