turn-off-system-restore

id: f4c234fd-2889-41b6-ad4b-df257adf882b
name: turn-off-system-restore
description: |
  This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
  In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
  The following query detects attempts to stop System Restore, which would prevent the user from recovering data by going back to a restore point.
  The See also section below lists more queries related to techniques shared by these campaigns.
  Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense evasion
- Impact
query: |
  DeviceProcessEvents  
  | where Timestamp > ago(7d)  
  //Pivoting for rundll32  
  and InitiatingProcessFileName =~ 'rundll32.exe'   
  //Looking for empty command line   
  and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != ""  
  //Looking for schtasks.exe as the created process  
  and FileName in~ ('schtasks.exe')  
  //Disabling system restore   
  and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' 
  and ProcessCommandLine has 'disable'