User Activity from Stopping Windows Defensive Services
Hypothesis and description
Spyware and malware remain a serious problem and Microsoft developed security services, Windows Defender and Windows Firewall, to combat this threat. In the event Windows Defender or Windows Firewall is turned off, administrators should correct the issue immediately to prevent the possibility of infection or further infection and investigate to determine if caused by crash or user manipulation.
Stopping services events are Windows Event Code 7036.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2016-04-15
- Contributors
- MITRE/NSA
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1562 Impair DefensesT1562.001 | Stealth (formerly Defense Evasion) | Low |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Pseudocode and implementations
Windows Event code 7036 from the System log identifies if a service has stopped or started. This analytic looks for "Windows Defender" or "Windows Firewall" that has stopped.
log_name == "System" AND
event_code == "7036"
param1 in ["Windows Defender", "Windows Firewall"] AND
param2 == "stopped"LogPoint version of the above pseudocode.
norm_id=WinServer channel="System" event_id=7036 param1 in ["Windows Defender", "Windows Firewall"] param2="stopped"Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-RKDRegistry Key Deletion1 shared
- D3-SYSVASystem Vulnerability Assessment1 shared
- D3-SDMSystem Daemon Monitoring1 shared
- D3-ACHApplication Configuration Hardening1 shared
- D3-DRADisable Remote Access1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
- D3-NNINetwork Node Inventory1 shared
- D3-PLMPhysical Link Mapping1 shared
- D3-SICASystem Init Config Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared