Detection rules › Kusto Query Language

Starting or Stopping HealthService to Avoid Detection

Source: upstream

'This query detects events where an actor is stopping or starting HealthService to disable telemetry collection/detection from the agent. The query requires a SACL to audit for access request to the service.'

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1562.001` Impair Defenses: Disable or Modify Tools

Event coverage

Provider	Event ID	Title
Security-Auditing	4624	An account was successfully logged on.
Security-Auditing	4656	A handle to an object was requested.

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

EventID eq "4656"

Stage 3: `extend`

Stage 4: `mv-expand`

Stage 5: `evaluate`

Stage 6: `extend`

Stage 7: `evaluate`

Stage 8: `extend`

Stage 9: `where`

and
  ObjectName is_not_null
  ObjectServer is_not_null
  ObjectType is_not_null

Stage 10: `where`

and
  ObjectName eq "HealthService"
  ObjectServer eq "SC Manager"
  ObjectType eq "SERVICE OBJECT"

Stage 11: `join`

Stage 12: `project`

Stage 13: `extend`

Stage 14: `extend`

Stage 15: `extend`

Stage 16: `extend`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`EventID`	eq	`4656`
`ObjectName`	eq	`HealthService`
`ObjectServer`	eq	`SC Manager`
`ObjectType`	eq	`SERVICE OBJECT`

Starting or Stopping HealthService to Avoid Detection

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: mv-expand

Stage 5: evaluate

Stage 6: extend

Stage 7: evaluate

Stage 8: extend

Stage 9: where

Stage 10: where

Stage 11: join

Stage 12: project

Stage 13: extend

Stage 14: extend

Stage 15: extend

Stage 16: extend