Turning off System Restore

Description

This query identifies attempts to stop System Restore and prevent the system from creating restore points, which can be used to recover data encrypted by ransomware

Query · kql

DeviceProcessEvents
//Pivoting for rundll32  
| where InitiatingProcessFileName =~ 'rundll32.exe'   
//Looking for empty command line   
and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != ""  
//Looking for schtasks.exe as the created process  
and FileName in~ ('schtasks.exe')  
//Disabling system restore   
and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' 
and ProcessCommandLine has 'disable'
Raw source Turning off System Restore · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5de97d18-b12b-4acf-9c3e-c96a67e80312
name: Turning off System Restore
description: |
  This query identifies attempts to stop System Restore and prevent the system from creating restore points, which can be used to recover data encrypted by ransomware
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  DeviceProcessEvents
  //Pivoting for rundll32  
  | where InitiatingProcessFileName =~ 'rundll32.exe'   
  //Looking for empty command line   
  and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != ""  
  //Looking for schtasks.exe as the created process  
  and FileName in~ ('schtasks.exe')  
  //Disabling system restore   
  and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' 
  and ProcessCommandLine has 'disable'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.