Query: detect Detects disabling security tools in logs
Matching passage: Sigma rule: Detects disabling security tools. Logsource: linux / process_creation. Rule: title: Disabling Security Tools id: e3a8a052-111f-4606-9aee-f28ebeb76776 status: test description: Detects disabling security tools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md author: Ömer Günal, Alejandro Ortuno, oscd.community date: 2020-06-17 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1686 logsource: category: process_creation product: linux detection: selection_iptables_1: Image|endswith: /service CommandLine|contains|all: - iptables - stop selection_iptables_2: Image|endswith: /service CommandLine|contains|all: - ip6tables - stop selection_iptables_3: Image|endswith: /chkconfig CommandLine|contains|all: - iptables - stop selection_iptables_4: Image|endswith: /chkconfig CommandLine|contains|all: - ip6tables - stop selection_firewall_1: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - stop selection_firewall_2: Image|endswith: /systemctl CommandLine|contains|all: - firewalld - disable selection_carbonblack_1: Image|endswith: /service CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_2: Image|endswith: /chkconfig CommandLine|contains|all: - cbdaemon - 'off' selection_carbonblack_3: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - stop selection_carbonblack_4: Image|endswith: /systemctl CommandLine|contains|all: - cbdaemon - disable selection_selinux: Image|endswith: /setenforce CommandLine|contains: '0' selection_crowdstrike_1: Image|endswith: /systemctl CommandLine|contains|all: - stop - falcon-sensor selection_crowdstrike_2: Image|endswith: /systemctl CommandLine|contains|all: - disable - falcon-sensor condition: 1 of selection* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system. Logsource: windows / process_creation. Rule: title: Set Suspicious Files as System Files Using Attrib.EXE id: efec536f-72e8-4656-8960-5e85d091345b related: - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b type: derived status: test description: 'Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs ' references: - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4 - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0 - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +s' selection_paths: CommandLine|contains: - ' %' - \Users\Public\ - \AppData\Local\ - \ProgramData\ - \Downloads\ - \Windows\Temp\ selection_ext: CommandLine|contains: - .bat - .dll - .exe - .hta - .ps1 - .vbe - .vbs filter_optional_installer: CommandLine|contains|all: - \Windows\TEMP\ - .exe condition: all of selection* and not 1 of filter_optional_* falsepositives: - Unknown level: high