Elastic Defend high stable eql

Shadow Copy Service Disabled via Registry Modification

Identifies attempt to disable the Windows Shadow Copy service via registry modification. Malware may include this type of suspicious service start changes to decrease system recovery chances.

View Source

Detection Logic

registry where
 registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\VSS\\Start" and registry.data.strings : "4" and
 not process.executable : "?:\\Windows\\System32\\services.exe" and process.executable : "?*" and
 not (process.code_signature.subject_name == "Enestech Software (Cyprus) Ltd" and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...