Detection rules › Splunk

Windows Service Deletion In Registry

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects the deletion of a service from the Windows Registry under CurrentControlSet\Services. It leverages data from the Endpoint.Registry datamodel, specifically monitoring registry paths and actions related to service deletion. This activity is significant as adversaries may delete services to evade detection and hinder incident response efforts. If confirmed malicious, this action could disrupt legitimate services, impair system functionality, and potentially allow attackers to maintain a lower profile within the environment, complicating detection and remediation efforts.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1489 Service Stop

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE ((Registry.action="modified" Registry.registry_value_data=0x00000001 Registry.registry_value_name="DeleteFlag") OR Registry.action="deleted") Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.actioneq
  • deleted corpus 8 (splunk 8)
  • modified corpus 5 (splunk 5)
Registry.registry_patheq
  • "*\\SYSTEM\\CurrentControlSet\\Services*" corpus 2 (splunk 2)
Registry.registry_value_dataeq
  • 0x00000001 corpus 12 (splunk 12)
Registry.registry_value_nameeq
  • DeleteFlag