Query: rule covering Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or
Matching passage: Sigma rule: Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or. Logsource: windows / process_creation. Rule: title: Suspicious Windows Service Tampering id: ce72ef99-22f1-43d4-8695-419dcb5d9330 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b type: obsolete - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b type: obsolete status: test description: 'Detects the usage of binaries such as ''net'', ''sc'' or ''powershell'' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts ' references: - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) date: 2022-09-01 modified: 2025-08-27 tags: - attack.impact - attack.defense-impairment - attack.t1489 - attack.t1685 logsource: category: process_creation product: windows detection: selection_tools_img: - OriginalFileName: - net.exe - net1.exe - PowerShell_ISE.EXE - PowerShell.EXE - psservice.exe - pwsh.dll - sc.exe - wmic.exe - Image|endswith: - \net.exe - \net1.exe - \PowerShell_ISE.EXE - \powershell.exe - \PsService.exe - \PsService64.exe - \pwsh.exe - \sc.exe - \wmic.exe selection_tools_cli: - CommandLine|contains: - ' delete ' - .delete() - ' pause ' - ' stop ' - 'Stop-Service ' - 'Remove-Service ' - CommandLine|contains|all: - config - start=disabled selection_services: CommandLine|contains: - 143Svc - Acronis VSS Provider - AcronisAgent - AcrSch2Svc - AdobeARMservice - AHS Service - Antivirus - Apache4 - ARSM - aswBcc - AteraAgent - Avast Business Console Client Antivirus Service - avast! Antivirus - AVG Antivirus - avgAdminClient - AvgAdminServer - AVP1 - BackupExec - bedbg - BITS - BrokerInfrastructure - CASLicenceServer - CASWebServer - Client Agent 7.60 - Core Browsing Protection - Core Mail Protection -
Near-miss passage: Sigma rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated. Logsource: windows / network_connection. Rule: title: Uncommon Connection to Active Directory Web Services id: b3ad3c0f-c949-47a1-a30e-b0491ccae876 status: test description: 'Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management. ' references: - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: category: network_connection product: windows detection: selection: Initiated: true DestinationPort: 9389 filter_main_dsac: Image: C:\Windows\system32\dsac.exe filter_main_ms_monitoring_agent: Image: C:\Program Files\Microsoft Monitoring Agent\ filter_main_powershell: Image|startswith: - C:\Program Files\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\7-preview\pwsh.ex - C:\Windows\System32\WindowsPowerShell\ - C:\Windows\SysWOW64\WindowsPowerShell\ condition: selection and not 1 of filter_main_* falsepositives: - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives. level: medium