[[ fm.text ]] Click here

High-confidence security tool disable via command line

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

High-confidence detection of explicit CLI-based disabling of security/EDR/AV tools with named process or service targets.

title: High-confidence security tool disable via command line
id: 7f1a3c2e-0c9f-4e3a-9f45-1c4b2a9d6e3f
status: experimental
description: |
  High-confidence detection of explicit CLI-based disabling of security/EDR/AV tools with named process or service targets. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  La règle signale un comportement potentiellement suspect. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
  - https://attack.mitre.org/techniques/T1562/001/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-02-08
modified: 2026-06-21
# SECOND PASS CHALLENGE 2026-06-21: fixed critical YAML duplicate-key bug in sc/net/wmic selections
# (duplicate CommandLine|contains keys → first key silently overwritten, 'stop' atom was never evaluated).
# Split into separate selections. Added net1.exe coverage (alias for net.exe).
related:
  - id: 3c2d9b7a-9f4d-4b8f-8c2a-6a7a2f7b1c4e
    type: similar
  - id: 5d6b7a2c-3f2e-4b91-9a7e-8f9c1b2a7d11
    type: similar
tags: []
logsource:
  category: process_creation
  product: windows

detection:
  selection_taskkill_im:
    Image|endswith: '\taskkill.exe'
    CommandLine|contains|all:
      - '/F'
      - '/IM'
    CommandLine|contains:
      - 'MsMpEng.exe'
      - 'SenseIR.exe'
      - 'SenseCE.exe'
      - 'CSFalconService.exe'
      - 'cb.exe'
      - 'RepUx.exe'
      - 'SentinelAgent.exe'
      - 'Sysmon.exe'

  # BLIND SPOT FIX 2026-06-21 (second pass): duplicate YAML key bug - two `CommandLine|contains:`
  # entries in the same mapping block cause the first one ('stop') to be silently overwritten by
  # the second (the service-name list). Result: 'stop' was never checked; the rule matched any
  # sc.exe/net.exe invocation that mentioned a service name, regardless of the action.
  # Fixed by merging both conditions into a single `CommandLine|contains|all:` block.
  selection_sc_stop_service:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'WinDefend'
    # NOTE: the above `contains|all` is a minimal anchor. Extend to cover WdNisSvc/Sense/
    # SecurityHealthService by adding OR branches at the condition level, or split into
    # separate selections if your SIEM supports it. Full coverage is provided by the
    # condition block referencing all selection_sc_* branches below.

  selection_sc_stop_service_wdnissvc:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'WdNisSvc'

  selection_sc_stop_service_sense:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'Sense'

  selection_sc_stop_service_sechealth:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'SecurityHealthService'

  # BLIND SPOT FIX (second pass): `net1.exe` is a legitimate alias for `net.exe` on Windows.
  # Attackers may invoke net1 stop WinDefend to evade rules that only check for net.exe.
  selection_net_stop_service:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'WinDefend'

  selection_net_stop_service_wdnissvc:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'WdNisSvc'

  selection_net_stop_service_sense:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'Sense'

  selection_net_stop_service_sechealth:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'SecurityHealthService'

  selection_powershell_defender_tamper:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'Add-MpPreference'
      - 'ExclusionPath'
      - 'ExclusionProcess'
      - 'ExclusionExtension'

  # BLIND SPOT FIX (second pass): same duplicate YAML key bug as sc/net above.
  # `CommandLine|contains|all` and `CommandLine|contains` in the same block → only the last survives.
  # Replaced with a single `contains|all` block that requires all atoms to be present.
  selection_wmic_delete_security_process:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'process'
      - 'where'
      - 'delete'
      - 'MsMpEng'

  selection_wmic_delete_falcon:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'process'
      - 'where'
      - 'delete'
      - 'CSFalconService'

  selection_wmic_delete_sense:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'process'
      - 'where'
      - 'delete'
      - 'SenseIR'

  filter_main_legitimate_admin_tools:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\TrustedInstaller.exe'
      - '\ccmexec.exe'

  # Updated condition to reference all new split selections (YAML duplicate-key bug fix)
  # Also adds: net1.exe coverage (alias for net.exe) and pwsh.exe already covered via selection_powershell_defender_tamper
  condition: >
    (
      selection_taskkill_im
      or selection_sc_stop_service
      or selection_sc_stop_service_wdnissvc
      or selection_sc_stop_service_sense
      or selection_sc_stop_service_sechealth
      or selection_net_stop_service
      or selection_net_stop_service_wdnissvc
      or selection_net_stop_service_sense
      or selection_net_stop_service_sechealth
      or selection_powershell_defender_tamper
      or selection_wmic_delete_security_process
      or selection_wmic_delete_falcon
      or selection_wmic_delete_sense
    )
    and not filter_main_legitimate_admin_tools

fields:
  - UtcTime
  - Computer
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Security administrators explicitly disabling Defender features during documented maintenance windows
  - Endpoint hardening or golden image scripts that set Defender exclusions (parent msiexec/TrustedInstaller - filtered)
  - SCCM/ConfigMgr (ccmexec.exe) managed deployments that reconfigure AV settings (filtered)
  - Incident response containment actions where defenders stop EDR components under a change ticket

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ae075c88-f3b9-4ab7-a6cf-ece1f6317ba7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion