IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
SolarWinds Process Disabling Services via Registry
editSolarWinds Process Disabling Services via Registry
editIdentifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-endpoint.events.*
- logs-windows.*
- endgame-*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Tactic: Initial Access
- Data Source: Elastic Endgame
- Data Source: Elastic Defend
Version: 107
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule query
editregistry where host.os.type == "windows" and registry.path : ( "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start", "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start" ) and registry.data.strings : ("4", "0x00000004") and process.name : ( "SolarWinds.BusinessLayerHost*.exe", "ConfigurationWizard*.exe", "NetflowDatabaseMaintenance*.exe", "NetFlowService*.exe", "SolarWinds.Administration*.exe", "SolarWinds.Collector.Service*.exe", "SolarwindsDiagnostics*.exe")
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
-
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/
-
Technique:
- Name: Modify Registry
- ID: T1112
- Reference URL: https://attack.mitre.org/techniques/T1112/
-
Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
-
Technique:
- Name: Supply Chain Compromise
- ID: T1195
- Reference URL: https://attack.mitre.org/techniques/T1195/
-
Sub-technique:
- Name: Compromise Software Supply Chain
- ID: T1195.002
- Reference URL: https://attack.mitre.org/techniques/T1195/002/