Query: Sigma rule for Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or
Matching passage: Sigma rule: Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or. Logsource: windows / process_creation. Rule: title: Suspicious Windows Service Tampering id: ce72ef99-22f1-43d4-8695-419dcb5d9330 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b type: obsolete - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b type: obsolete status: test description: 'Detects the usage of binaries such as ''net'', ''sc'' or ''powershell'' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts ' references: - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) date: 2022-09-01 modified: 2025-08-27 tags: - attack.impact - attack.defense-impairment - attack.t1489 - attack.t1685 logsource: category: process_creation product: windows detection: selection_tools_img: - OriginalFileName: - net.exe - net1.exe - PowerShell_ISE.EXE - PowerShell.EXE - psservice.exe - pwsh.dll - sc.exe - wmic.exe - Image|endswith: - \net.exe - \net1.exe - \PowerShell_ISE.EXE - \powershell.exe - \PsService.exe - \PsService64.exe - \pwsh.exe - \sc.exe - \wmic.exe selection_tools_cli: - CommandLine|contains: - ' delete ' - .delete() - ' pause ' - ' stop ' - 'Stop-Service ' - 'Remove-Service ' - CommandLine|contains|all: - config - start=disabled selection_services: CommandLine|contains: - 143Svc - Acronis VSS Provider - AcronisAgent - AcrSch2Svc - AdobeARMservice - AHS Service - Antivirus - Apache4 - ARSM - aswBcc - AteraAgent - Avast Business Console Client Antivirus Service - avast! Antivirus - AVG Antivirus - avgAdminClient - AvgAdminServer - AVP1 - BackupExec - bedbg - BITS - BrokerInfrastructure - CASLicenceServer - CASWebServer - Client Agent 7.60 - Core Browsing Protection - Core Mail Protection -
Near-miss passage: Sigma rule: Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and othe. Logsource: windows / windefend. Rule: title: Windows Defender Grace Period Expired id: 360a1340-398a-46b6-8d06-99b905dc69d2 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: 'Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled. ' references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5101 condition: selection falsepositives: - Unknown level: high