{"id":"4a6713f6-3331-11ed-a261-0242ac120002","title":"Taskkill Symantec Endpoint Protection","description":"Detects one of the possible scenarios for disabling Symantec Endpoint Protection.\nSymantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism.\nAs a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.\n","author":"Ilya Krestinichev, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-13","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.exploit-db.com/exploits/37525","https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection","https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer"],"source_path":"rules/windows/process_creation/proc_creation_win_taskkill_sep.yml","source_sha256":"f63f3ec74052dd4823a9974380be47d8f5ca68cfffc77732a87508c35eb466a4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Taskkill Symantec Endpoint Protection\nid: 4a6713f6-3331-11ed-a261-0242ac120002\nstatus: test\ndescription: |\n    Detects one of the possible scenarios for disabling Symantec Endpoint Protection.\n    Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism.\n    As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.\nreferences:\n    - https://www.exploit-db.com/exploits/37525\n    - https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection\n    - https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer\nauthor: Ilya Krestinichev, Florian Roth (Nextron Systems)\ndate: 2022-09-13\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'taskkill'\n            - ' /F '\n            - ' /IM '\n            - 'ccSvcHst.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/4a6713f6-3331-11ed-a261-0242ac120002.json","kind":"sigma"}