[rule]
description = """
Identifies attempt to disable the Windows Shadow Copy service via registry modification. Malware may include this type
of suspicious service start changes to decrease system recovery chances.
"""
id = "b2409cd4-3b23-4b2d-82e4-bbb25594999a"
license = "Elastic License v2"
name = "Shadow Copy Service Disabled via Registry Modification"
os_list = ["windows"]
version = "1.0.28"
query = '''
registry where
registry.path : "HKLM\\SYSTEM\\ControlSet*\\Services\\VSS\\Start" and registry.data.strings : "4" and
not process.executable : "?:\\Windows\\System32\\services.exe" and process.executable : "?*" and
not (process.code_signature.subject_name == "Enestech Software (Cyprus) Ltd" and process.code_signature.trusted == true)
'''
min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"
[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"
[internal]
min_endpoint_version = "8.4.0"