Taskkill Symantec Endpoint Protection

calendar Oct 17, 2023 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

Sigma rule (View on GitHub)

 1title: Taskkill Symantec Endpoint Protection
 2id: 4a6713f6-3331-11ed-a261-0242ac120002
 3status: test
 4description: |
 5    Detects one of the possible scenarios for disabling Symantec Endpoint Protection.
 6    Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism.
 7    As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.    
 8references:
 9    - https://www.exploit-db.com/exploits/37525
10    - https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection
11    - https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer
12author: Ilya Krestinichev, Florian Roth (Nextron Systems)
13date: 2022/09/13
14tags:
15    - attack.defense_evasion
16    - attack.t1562.001
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        CommandLine|contains|all:
23            - 'taskkill'
24            - ' /F '
25            - ' /IM '
26            - 'ccSvcHst.exe'
27    condition: selection
28falsepositives:
29    - Unknown
30level: high

References

Related rules

to-top