Elastic Defend high stable eql

Unusual Windows System Service Disabled

Identifies attempts to disable certain Windows security related services such as the Windows Defender or System Updates via registry modification.

View Source

Detection Logic

registry where
 registry.value : "Start" and registry.data.strings == "4" and
 process.executable != null and registry.path != null and 
 registry.path :
         ("HKLM\\SYSTEM\\ControlSet001\\Services\\WinDefend\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\SecurityHealthService\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\Sense\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdBoot\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdFilter\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdNisDrv\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\WdNisSvc\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\wscsvc\\Start",
          "HKLM\\SYSTEM\\ControlSet001\\Services\\EventLog\\Start") and
 not process.executable : ("?:\\Windows\\System32\\reg.exe", "?:\\Windows\\regedit.exe") and
 not (process.code_signature.subject_name in ("Connectwise, LLC", "Enestech Software (Cyprus) Ltd") and process.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...