Detection rules › Splunk

Disabling Defender Services

Author
Teoderick Contreras, Splunk, Steven Dick
Source
upstream

The following analytic detects the disabling of Windows Defender services by monitoring registry modifications. It leverages registry event data to identify changes to specific registry paths associated with Defender services, where the 'Start' value is set to '0x00000004'. This activity is significant because disabling Defender services can indicate an attempt by an adversary to evade detection and maintain persistence on the endpoint. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches or system compromise.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.001 Impair Defenses: Disable or Modify Tools

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE Registry.registry_path="*\\System\\CurrentControlSet\\Services\\*" Registry.registry_path IN ("*SecurityHealthService*", "*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*", "*WinDefend*") Registry.registry_value_data=0x00000004 Registry.registry_value_name="Start" BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: where

where isnotnull(registry_value_data)

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*\\System\\CurrentControlSet\\Services\\*"
Registry.registry_pathin
  • "*SecurityHealthService*"
  • "*WdBoot*"
  • "*WdFilter*"
  • "*WdNisDrv*"
  • "*WdNisSvc*"
  • "*WinDefend*"
Registry.registry_value_dataeq
  • 0x00000004
Registry.registry_value_nameeq
  • Start