Techniques
Sample rules
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
- source: splunk
- technicques:
- T1562.001
Description
The following analytic detects the use of the sfc.exe utility with the “-u” parameter, which is part of the Cisco Secure Endpoint installation. The “-u” flag allows the uninstallation of Cisco Secure Endpoint components. This detection leverages endpoint telemetry to monitor command-line executions that include the “-u” parameter. The use of this flag is significant as it could indicate an attempt to disable or remove endpoint protection, potentially leaving the system vulnerable to further exploitation. If identified as malicious, this action may be part of a broader effort to disable security mechanisms and avoid detection.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -u*" NOT Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc_filter`
Windows Cisco Secure Endpoint Unblock File Via Sfc
- source: splunk
- technicques:
- T1562.001
Description
The following analytic detects the use of the sfc.exe utility with the “-unblock” parameter, a feature within Cisco Secure Endpoint. The “-unblock” flag is used to remove system blocks imposed by the endpoint protection. This detection focuses on command-line activity that includes the “-unblock” parameter, as it may indicate an attempt to restore access to files or processes previously blocked by the security software. While this action could be legitimate in troubleshooting scenarios, malicious actors might use it to override protective measures, enabling execution of blocked malicious payloads or bypassing other security mechanisms.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -unblock *" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_cisco_secure_endpoint_unblock_file_via_sfc_filter`
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
- source: splunk
- technicques:
- T1562.001
Description
The following analytic detects the use of the sfc.exe utility, in order to stop the Immunet Protect service. The Sfc.exe utility is part of Cisco Secure Endpoint installation. This detection leverages telemetry from the endpoint, focusing on command-line executions involving the -k parameter. This activity is significant as it indicates potential tampering with defensive mechanisms. If confirmed malicious, attackers could partially blind the EDR, enabling further compromise and lateral movement within the network.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="sfc.exe" Processes.process="* -k*" AND NOT Processes.process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*", ":\\Windows\\WinSxS\\*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_cisco_secure_endpoint_stop_immunet_service_via_sfc_filter`