SolarWinds Process Disabling Services via Registry

  1[metadata]
  2creation_date = "2020/12/14"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this
 11technique to manipulate relevant security services.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "logs-endpoint.events.registry-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21    "logs-crowdstrike.fdr*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "SolarWinds Process Disabling Services via Registry"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating SolarWinds Process Disabling Services via Registry
 32
 33SolarWinds software is integral for network management, often requiring deep system access. Adversaries may exploit this by altering registry settings to disable critical services, evading detection. The detection rule identifies changes to service start types by specific SolarWinds processes, flagging potential misuse aimed at disabling security defenses. This proactive monitoring helps mitigate risks associated with unauthorized registry modifications.
 34
 35### Possible investigation steps
 36
 37- Review the process name involved in the alert to confirm it matches one of the specified SolarWinds processes, such as "SolarWinds.BusinessLayerHost*.exe" or "NetFlowService*.exe".
 38- Examine the registry path in the alert to ensure it corresponds to the critical service start type locations, such as "HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start".
 39- Check the registry data value to verify if it has been set to "4" (disabled), indicating a potential attempt to disable a service.
 40- Investigate the timeline of the registry change event to identify any preceding or subsequent suspicious activities on the host.
 41- Correlate the alert with other security logs or alerts from data sources like Sysmon or Microsoft Defender XDR to identify any related malicious activities or patterns.
 42- Assess the impacted service to determine its role in security operations and evaluate the potential impact of it being disabled.
 43- Contact the system owner or administrator to verify if the registry change was authorized or part of a legitimate maintenance activity.
 44
 45### False positive analysis
 46
 47- Routine updates or maintenance by SolarWinds software may trigger registry changes. Verify if the process corresponds to a scheduled update or maintenance task and consider excluding these specific processes during known maintenance windows.
 48- Legitimate configuration changes by IT administrators using SolarWinds tools can appear as registry modifications. Confirm with the IT team if the changes align with authorized configuration activities and create exceptions for these known activities.
 49- Automated scripts or tools that utilize SolarWinds processes for legitimate network management tasks might cause false positives. Review the scripts or tools in use and whitelist them if they are verified as safe and necessary for operations.
 50- Temporary service modifications for troubleshooting purposes by SolarWinds processes can be mistaken for malicious activity. Ensure that any troubleshooting activities are documented and create temporary exceptions during these periods.
 51
 52### Response and remediation
 53
 54- Immediately isolate the affected system from the network to prevent further unauthorized registry modifications and potential lateral movement by the adversary.
 55- Terminate any suspicious SolarWinds processes identified in the alert, such as "SolarWinds.BusinessLayerHost*.exe" or "NetFlowService*.exe", to halt any ongoing malicious activity.
 56- Restore the registry settings for the affected services to their original state, ensuring that critical security services are re-enabled and configured to start automatically.
 57- Conduct a thorough review of the affected system for additional signs of compromise, including unauthorized user accounts, scheduled tasks, or other persistence mechanisms.
 58- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the breach.
 59- Implement enhanced monitoring on the affected system and similar environments to detect any future unauthorized registry changes, leveraging data sources like Sysmon and Microsoft Defender XDR.
 60- Review and update access controls and permissions for SolarWinds processes to limit their ability to modify critical system settings, reducing the risk of future exploitation."""
 61references = [
 62    "https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor",
 63]
 64risk_score = 47
 65rule_id = "b9960fef-82c6-4816-befa-44745030e917"
 66severity = "medium"
 67tags = [
 68    "Domain: Endpoint",
 69    "OS: Windows",
 70    "Use Case: Threat Detection",
 71    "Tactic: Defense Evasion",
 72    "Tactic: Initial Access",
 73    "Data Source: Elastic Endgame",
 74    "Data Source: Elastic Defend",
 75    "Data Source: Sysmon",
 76    "Data Source: Microsoft Defender XDR",
 77    "Data Source: SentinelOne",
 78    "Data Source: Crowdstrike",
 79    "Resources: Investigation Guide",
 80    "Noise: Low",
 81    "Performance: Normal",
 82    "Profile: Recommended",
 83    "Threat: Supply Chain",
 84    "Rule Type: Event Correlation (EQL)",
 85    "Platform: Windows",
 86]
 87timestamp_override = "event.ingested"
 88type = "eql"
 89
 90query = '''
 91registry where host.os.type == "windows" and event.type == "change" and registry.value : "Start" and
 92  process.name : (
 93      "SolarWinds.BusinessLayerHost*.exe",
 94      "ConfigurationWizard*.exe",
 95      "NetflowDatabaseMaintenance*.exe",
 96      "NetFlowService*.exe",
 97      "SolarWinds.Administration*.exe",
 98      "SolarWinds.Collector.Service*.exe",
 99      "SolarwindsDiagnostics*.exe"
100  ) and
101  registry.path : "*\\SYSTEM\\*ControlSet*\\Services\\*\\Start" and
102  registry.data.strings : ("4", "0x00000004")
103'''
104
105setup = """## Setup
106
107This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
108
109Setup instructions: https://ela.st/install-elastic-defend
110
111### Additional data sources
112
113This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
114
115- [CrowdStrike](https://ela.st/crowdstrike-integration)
116- [Microsoft Defender XDR](https://ela.st/m365-defender)
117- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
118- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
119"""
120
121
122[[rule.threat]]
123framework = "MITRE ATT&CK"
124
125[[rule.threat.technique]]
126id = "T1112"
127name = "Modify Registry"
128reference = "https://attack.mitre.org/techniques/T1112/"
129
130[[rule.threat.technique]]
131id = "T1562"
132name = "Impair Defenses"
133reference = "https://attack.mitre.org/techniques/T1562/"
134
135[[rule.threat.technique.subtechnique]]
136id = "T1562.001"
137name = "Disable or Modify Tools"
138reference = "https://attack.mitre.org/techniques/T1562/001/"
139
140[rule.threat.tactic]
141id = "TA0005"
142name = "Defense Evasion"
143reference = "https://attack.mitre.org/tactics/TA0005/"
144
145[[rule.threat]]
146framework = "MITRE ATT&CK"
147
148[[rule.threat.technique]]
149id = "T1195"
150name = "Supply Chain Compromise"
151reference = "https://attack.mitre.org/techniques/T1195/"
152
153[[rule.threat.technique.subtechnique]]
154id = "T1195.002"
155name = "Compromise Software Supply Chain"
156reference = "https://attack.mitre.org/techniques/T1195/002/"
157
158[rule.threat.tactic]
159id = "TA0001"
160name = "Initial Access"
161reference = "https://attack.mitre.org/tactics/TA0001/"