mirror of
https://github.com/keyboardcrunch/sentinelone-queries
synced 2026-06-08 17:07:13 +00:00
keyboardcrunch
18 lines
831 B
YAML
18 lines
831 B
YAML
title: Disable or Modify Service Execution
|
|
description: Detect the modification of service start type for defense evasion. Tuning will be required as many installers and updaters change service states.
|
|
author: keyboardcrunch
|
|
date: 18/12/2020
|
|
modified:
|
|
mitre:
|
|
tactic: Defense Evasion
|
|
technique: T1562
|
|
subtechnique: 001
|
|
operating_system: windows
|
|
query: (RegistryKeyPath RegExp "\bMACHINE\\SYSTEM\\.*ControlSet.*\\Services\\.*\\Start" AND EventType = "Registry Value Modified") AND SrcProcParentName Not In ("services.exe","svchost.exe","smss.exe","WmiPrvSE.exe","wininit.exe","TiWorker.exe","msiexec.exe","OfficeClickToRun.exe") AND SrcProcName Not In ("GoogleUpdate.exe")
|
|
false_positives:
|
|
- Updater services such as those for Chrome/Edge
|
|
- MSI installations
|
|
- Explicitly adjusted service states
|
|
tags:
|
|
references:
|