Detect Exploitation for Defense Evasion in Splunk
Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them. Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery. There have also been examples of vulnerabilities in public cloud infrastructure and SaaS applications that may bypass defense boundaries, evade security logs, or deploy hidden infrastructure.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1211 Exploitation for Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1211/
SPL Detection Query
| union
(
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval SecurityParent=if(match(ParentImage, "(?i)(MsMpEng|MsSense|SenseCncProxy|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|CbDefense|mbam|sophosssp|SAVService|avp\.exe|avgnt|AvastSvc)"), 1, 0)
| eval SuspiciousChild=if(match(Image, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|msiexec\.exe|csc\.exe|msbuild\.exe|wmic\.exe)"), 1, 0)
| where SecurityParent=1 AND SuspiciousChild=1
| eval DetectionSignal="SecuritySoftwareSpawnedSuspiciousChild"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionSignal
)
(
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| eval TargetIsSecurity=if(match(TargetImage, "(?i)(MsMpEng|MsSense|SenseCncProxy|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|CbDefense|mbam|sophosssp|SAVService|avp\.exe|avgnt|AvastSvc)"), 1, 0)
| eval SourceIsSystem=if(match(SourceImage, "(?i)(System|svchost\.exe|lsass\.exe|csrss\.exe|wininit\.exe|services\.exe|smss\.exe|WerFault\.exe)"), 1, 0)
| where TargetIsSecurity=1 AND SourceIsSystem=0
| eval HighPrivilegeAccess=if(match(GrantedAccess, "(0x1F0FFF|0x1F1FFF|0x143A|0x1410|0x1fffff)"), 1, 0)
| eval DetectionSignal="SuspiciousAccessToSecurityProcess"
| table _time, host, SourceImage, SourceCommandLine, TargetImage, GrantedAccess, HighPrivilegeAccess, DetectionSignal
)
(
search index=wineventlog sourcetype="WinEventLog:System" (EventCode=7034 OR EventCode=7035 OR EventCode=7036 OR EventCode=7045)
| eval ServiceNameLower=lower(ServiceName)
| eval IsSecurityService=if(match(ServiceNameLower, "(sense|windefend|falcon|sentinelagent|cylancesvc|cbdefense|mbam|sophosssp|kaspersky|avast|avgnt)"), 1, 0)
| where IsSecurityService=1
| eval DetectionSignal="SecurityServiceModifiedOrStopped"
| table _time, host, ServiceName, EventCode, Message, DetectionSignal
)
| sort - _timeDetects exploitation of defensive security software using three Sysmon and Windows event signals: (1) Sysmon Event ID 1 (Process Create) where security software is the parent process and spawned child is a known LOLBin or script interpreter; (2) Sysmon Event ID 10 (Process Access) where non-system processes open handles to security software processes, particularly with high-privilege access rights; (3) Windows System Event IDs 7034/7035/7036/7045 indicating security service crashes, state changes, or unexpected new service installations. The union of these signals provides layered coverage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Security software self-update processes legitimately spawn cmd.exe or msiexec.exe during patch installation
- IT management and RMM tools (ConnectWise, Kaseya, TeamViewer) may access security processes during managed operations
- Antivirus vendors' own diagnostic and support utilities trigger process access events against their parent service
- Windows Error Reporting (WerFault.exe) opens handles to any crashed process — security software included — during crash dump collection
- Service Control Manager legitimate service state transitions (7035/7036) during normal startup/shutdown sequences
Other platforms for T1211
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate Security Process Spawning Command Shell
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe (or the process running the test). Security Event ID 4688 if command line auditing is enabled. The detection signal 'SecuritySoftwareSpawnedSuspiciousChild' may not fire unless the initiating process name matches the security process list — use this test to validate the detection logic by temporarily adding 'powershell.exe' to the SecurityProcesses list in a test environment.
- Test 2 Open Handle to Windows Defender Process (ProcessAccess Simulation)
Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe, GrantedAccess=0x0400. Note: Windows Defender is Protected Process Light (PPL) — the OpenProcess call may be denied, but Sysmon still logs the attempt with CallTrace data showing the call stack.
- Test 3 Security Service State Query and Stop Simulation (Non-Destructive)
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'sc query WinDefend' and 'sc query Sense'. Security Event ID 4688 (if enabled). Sysmon Event ID 1 for wmic.exe with CommandLine containing 'service where name'. These are the same reconnaissance commands used by threat actors (including APT28 tooling) to identify security software before exploitation.
- Test 4 Exploit Artifact Simulation — Security Service Crash via WerFault
Expected signal: Sysmon Event ID 1: Process Create for werfault.exe with command line containing '-p 0'. Application Event Log queries via wevtutil generate additional Sysmon Event ID 1 entries for wevtutil.exe. The WerFault invocation with PID 0 will fail but the process creation telemetry is generated and matches patterns seen when security software is exploited and crashes.
References (7)
- https://attack.mitre.org/techniques/T1211/
- https://www.bleepingcomputer.com/news/security/hackers-exploited-salesforce-zero-day-in-facebook-phishing-attack/
- https://securitylabs.datadoghq.com/articles/bypass-cloudtrail-aws-service-catalog-and-other/
- https://www.bleepingcomputer.com/news/security/ghosttoken-gcp-flaw-let-attackers-backdoor-google-accounts/
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1211/T1211.md
- https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
Response Playbook
Triage
- Identify the specific security software involved — which product, version, and patch level? Cross-reference against known CVEs for that product (e.g., CVE-2024-20399 for Cisco NX-OS, CVE-2015-4902 for Java, vendor-specific EDR vulnerabilities). Check vendor security advisories published within the last 90 days.
- Examine the child process spawned by or the accessor of the security software: what command line was executed? Is it a recognizable LOLBin pattern (e.g., cmd.exe /c whoami, powershell.exe -enc ...) or a more targeted exploit payload?
- Check whether the security software process crashed (look for Windows Error Reporting events, WerFault.exe spawns, or dump files in C:\ProgramData\Microsoft\Windows\WER\) immediately before or after the suspicious activity — a crash often accompanies exploitation.
- Determine the timeline: what user-initiated or network-initiated activity occurred immediately before the anomaly? Review DeviceNetworkEvents and DeviceLogonEvents in the 5-minute window preceding the alert to identify a potential initial trigger.
- Check whether the security software is still functional after the event — query the current service state, verify definitions are current, and determine if real-time protection is still enabled. A successful exploit may leave the software in a degraded or disabled state.
- Determine if this is an isolated event or affects multiple hosts. Spread across multiple endpoints simultaneously suggests an automated exploitation campaign or worm-like propagation targeting the security software.
- Review the affected endpoint's network connections at the time of the event — did the security process or a child process make outbound connections? Capture destination IPs and domains for threat intelligence enrichment.
Containment
- If code execution from the security process is confirmed: immediately isolate the endpoint from the network using EDR network isolation or VLAN quarantine to prevent lateral movement or C2 communication.
- Force-update the affected security software to the latest version if a known CVE is implicated — check vendor emergency advisories. For Defender, run 'Update-MpSignature' and verify engine version matches latest release.
- If the security software is confirmed disabled or degraded: deploy an alternate detection capability (e.g., enable additional Windows audit policies, deploy a secondary EDR in passive mode) to maintain visibility during remediation.
- Block the specific exploit vector at the network perimeter: if the exploit was delivered via a specific protocol, port, or document format, apply temporary ACLs or proxy blocks until the endpoint is patched.
- Preserve volatile memory and disk artifacts before remediation — take a full memory dump and disk snapshot for forensic analysis, particularly if a novel exploitation technique may have been used.
- Revoke and rotate credentials for any accounts that were active on the compromised endpoint at the time of exploitation — assume credential theft may have occurred if the security software was bypassed.
- Notify the affected security software vendor of the potential vulnerability exploitation, especially if the technique appears novel and the CVE is unconfirmed — vendors maintain emergency response contacts for zero-day reports.
Evidence Collection
- Windows Error Reporting dumps: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ and C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ — minidumps and crash metadata for the exploited process
- Application Event Log: Event IDs 1000 (Application Error) and 1001 (Windows Error Reporting) documenting the faulting module, exception code (e.g., 0xC0000005 for access violation), and fault offset
- Sysmon Event ID 10 (ProcessAccess): SourceImage, TargetImage, GrantedAccess flags, and CallTrace showing the call stack at time of handle acquisition
- Sysmon Event ID 1 (Process Create): full command lines of any processes spawned by or from the security software around the time of the incident
- Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash): any files written to disk by the exploited security process or its children
- Prefetch files for the security software executable: C:\Windows\Prefetch\ — execution timestamps and loaded DLLs can reveal unexpected library loads
- Memory artifacts: full process memory dump of the affected security software process (if still running) using Task Manager or ProcDump: procdump.exe -ma <pid> <output_path>
- Network packet capture from the time window of the exploitation — particularly any exploit delivery traffic preceding the anomaly
- Registry key HKLM\SYSTEM\CurrentControlSet\Services\ for the affected security service — check for tampered service binary paths, DLL load order entries, or modified failure actions
Escalation Criteria
- !Code execution confirmed from a security software process — any child process spawned by MsMpEng.exe, csagent.exe, SentinelAgent.exe, or equivalent with no corresponding update activity in vendor logs
- !Security software confirmed disabled or unresponsive after the exploitation event — real-time protection off, definitions stale, or service in stopped state without authorized change record
- !Novel or unpatched CVE implicated — the faulting module and exception offset do not match any public CVE for the identified product version, suggesting a potential zero-day
- !Evidence of lateral movement following the exploitation event — authentication events from the affected endpoint to other hosts using domain accounts shortly after the alert
- !Multiple endpoints showing the same exploitation pattern within a short window — indicates coordinated attack or automated exploitation tool targeting the environment
- !Successful privilege escalation post-exploitation — process tree showing SYSTEM-level child processes spawned from the compromised security process
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Error Reporting crash reports: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ — contains minidumps, exception codes, and faulting module offsets for exploited processes - >
Application Event Log: Event ID 1000 (faulting application) with exception code 0xC0000005 (access violation) or 0xC0000374 (heap corruption) in the exploited security process - >
Sysmon Event ID 10 (ProcessAccess) logs: records GrantedAccess flags and CallTrace — look for PROCESS_VM_WRITE (0x0020) or PROCESS_ALL_ACCESS (0x1F0FFF) from unexpected source processes - >
Prefetch: C:\Windows\Prefetch\ — MSMPENG.EXE-*.pf or equivalent for the exploited process — unusual DLL loads visible in prefetch metadata - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\<SecurityServiceName>\ — ImagePath, ServiceDll, FailureActions — tampered entries indicate persistence after exploitation - >
File system: C:\Windows\System32\winevt\Logs\Application.evtx — Application event log containing crash and error entries for security software - >
Memory: heap spray artifacts, ROP gadgets, or shellcode stubs may be recoverable from a process memory dump of the exploited security software - >
Network captures: exploit delivery traffic often precedes the crash — PCAP from the 60-second window before the WER event may contain the exploit packet or malicious document delivery
Tuning Guidance
T1211 detections generate elevated false positive rates due to the similarity between exploitation artifacts and normal security software maintenance activities. Begin by building an authoritative inventory of your security software versions and their known update/maintenance behaviors — most EDR platforms document which system processes they spawn during updates. Whitelist specific parent process + child process + command line combinations that match your vendor's documented behavior, never wildcard entire source processes. For process access (Sysmon EID 10) alerts, start with GrantedAccess filtering: focus on 0x1F0FFF (PROCESS_ALL_ACCESS), 0x1F1FFF, and 0x143A (write + read + query) which are more indicative of exploitation than read-only access used by diagnostic tools. For service failure alerts, correlate with your patch management system — legitimate crashes during updates will cluster around maintenance windows. Cross-reference against NVD and vendor security advisories for your specific security product versions; detections should be prioritized when unpatched CVEs exist for the product. In cloud environments, supplement endpoint signals with CloudTrail (AWS) or Azure Activity Logs filtered for security service modifications, and monitor for the specific API calls documented in CVE write-ups (e.g., Service Catalog API abuse for CloudTrail bypass). Consider a 30-day baseline period before alerting to establish what normal process access patterns look like for your specific EDR product — the vendor's own processes will frequently appear as accessors of the main service.
Hunting Queries
Hunt for security software processes spawning LOLBin or script interpreter child processes over the past 7 days. Aggregated by hour and device to identify repeated exploitation attempts. A security process spawning cmd.exe or PowerShell is highly anomalous and indicates either exploitation or a misconfigured update mechanism.
// Hunt for security processes that have crashed (WerFault accessing them) or spawned anomalous children
let SecurityProcesses = dynamic(["MsMpEng.exe","MsSense.exe","csagent.exe","CSFalconService.exe","SentinelAgent.exe","CylanceSvc.exe","cb.exe","CbDefense.exe","mbam.exe","sophosssp.exe","avp.exe","AvastSvc.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any (SecurityProcesses)
| summarize ChildProcesses=make_set(FileName), CommandLines=make_set(ProcessCommandLine), Count=count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where array_length(ChildProcesses) > 0
| extend SuspiciousChildren = set_intersect(ChildProcesses, dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","msbuild.exe"]))
| where array_length(SuspiciousChildren) > 0
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval IsSecurityParent=if(match(ParentImage, "(?i)(MsMpEng|MsSense|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|CbDefense|mbam|sophosssp|avp\.exe|AvastSvc)"), 1, 0)
| where IsSecurityParent=1
| stats values(Image) as ChildImages, values(CommandLine) as ChildCmds, count as SpawnCount by host, ParentImage, span(_time, 1h)
| eval SuspiciousChildFound=if(mvfind(ChildImages, "(?i)(cmd\.exe|powershell|wscript|mshta|rundll32|certutil|bitsadmin|msbuild)") >= 0, 1, 0)
| where SuspiciousChildFound=1
| sort - _timeHunt for non-trusted processes opening handles to security software over the past 7 days. Aggregated by source process to identify tools that repeatedly access security software — an exploit framework will typically call OpenProcess on the target before injecting or triggering the vulnerability. High access counts from a single source are particularly suspicious.
// Hunt for high-privilege process access to security software from unusual source processes
let SecurityProcesses = dynamic(["MsMpEng.exe","MsSense.exe","csagent.exe","CSFalconService.exe","SentinelAgent.exe","CylanceSvc.exe","cb.exe","mbam.exe","sophosssp.exe","avp.exe","AvastSvc.exe"]);
let TrustedSources = dynamic(["svchost.exe","lsass.exe","services.exe","csrss.exe","wininit.exe","smss.exe","System","WerFault.exe","taskhostw.exe"]);
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "ProcessAccessed"
| where FileName has_any (SecurityProcesses)
| where not (InitiatingProcessFileName has_any (TrustedSources))
| where not (InitiatingProcessFileName has_any (SecurityProcesses))
| summarize AccessCount=count(), UniqueTargets=dcount(FileName), Targets=make_set(FileName) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by AccessCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| eval TargetIsSecurity=if(match(TargetImage, "(?i)(MsMpEng|MsSense|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|mbam|sophosssp|avp\.exe|AvastSvc)"), 1, 0)
| eval SourceTrusted=if(match(SourceImage, "(?i)(svchost\.exe|lsass\.exe|services\.exe|csrss\.exe|wininit\.exe|smss\.exe|WerFault\.exe|taskhostw\.exe)"), 1, 0)
| where TargetIsSecurity=1 AND SourceTrusted=0
| stats count as AccessCount, dc(TargetImage) as UniqueTargets, values(TargetImage) as Targets, values(GrantedAccess) as AccessRights by host, SourceImage, SourceCommandLine
| sort - AccessCountHunt for security service crash events (System Event IDs 7034/7036) correlated with suspicious process activity within a 5-minute window. Successful exploitation of security software often causes a service crash followed immediately by attacker-controlled command execution. This temporal correlation is a strong indicator of exploitation versus coincidental crashes.
// Hunt for security service crashes correlated with subsequent suspicious process activity
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("ServiceInstalled", "ServiceDeleted")
| where AdditionalFields has_any ("Sense", "WinDefend", "Falcon", "SentinelAgent", "CylanceSvc", "CbDefense", "MBAMService", "SophosSafestore")
| join kind=inner (
DeviceProcessEvents
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "sc.exe", "reg.exe")
| project SuspiciousTime=Timestamp, DeviceName, SuspiciousProcess=FileName, SuspiciousCmd=ProcessCommandLine
) on DeviceName
| where abs(datetime_diff('minute', Timestamp, SuspiciousTime)) <= 5
| project Timestamp, DeviceName, AdditionalFields, SuspiciousProcess, SuspiciousCmd
| sort by Timestamp descindex=wineventlog sourcetype="WinEventLog:System" (EventCode=7034 OR EventCode=7036)
| eval ServiceNameLower=lower(ServiceName)
| eval IsSecurityService=if(match(ServiceNameLower, "(sense|windefend|falcon|sentinelagent|cylancesvc|cbdefense|mbamservice|sophossafestore)"), 1, 0)
| where IsSecurityService=1
| eval crash_time=_time
| join type=inner host [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\net.exe" OR Image="*\\sc.exe" OR Image="*\\reg.exe")
| eval proc_time=_time
| table host, proc_time, Image, CommandLine
]
| eval TimeDelta=abs(crash_time - proc_time)
| where TimeDelta <= 300
| table _time, host, ServiceName, EventCode, Image, CommandLine, TimeDelta
| sort - _timeAtomic Red Team Tests
Creates a test process that mimics the parent-child relationship of an exploited security process spawning a command interpreter. Uses PowerShell to launch cmd.exe with a parent process spoof simulation via Start-Process with explicit parent PID. This tests whether the detection fires on the child process spawn signal without requiring an actual vulnerability exploit. Run in a test environment only.
Command
powershell.exe -Command "$psi = New-Object System.Diagnostics.ProcessStartInfo; $psi.FileName = 'cmd.exe'; $psi.Arguments = '/c whoami > $env:TEMP\df00tech-t1211-test.txt'; $psi.UseShellExecute = $false; [System.Diagnostics.Process]::Start($psi) | Out-Null; Write-Host 'T1211 simulation: cmd.exe spawned'"Cleanup
Remove-Item $env:TEMP\df00tech-t1211-test.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe (or the process running the test). Security Event ID 4688 if command line auditing is enabled. The detection signal 'SecuritySoftwareSpawnedSuspiciousChild' may not fire unless the initiating process name matches the security process list — use this test to validate the detection logic by temporarily adding 'powershell.exe' to the SecurityProcesses list in a test environment.
Expected Detection
With initiating process in SecurityProcesses list: DetectionSignal=SecuritySoftwareSpawnedSuspiciousChild fires. Validates child process spawn detection path in both KQL (ExploitedSecurityProcess union branch) and SPL (EventCode=1, SecurityParent=1 AND SuspiciousChild=1).
Attempts to open a handle to the Windows Defender engine process (MsMpEng.exe) using OpenProcess via PowerShell P/Invoke. This simulates the reconnaissance or pre-exploitation step where an adversary acquires a handle to the target security process. The access right 0x0400 (PROCESS_QUERY_INFORMATION) is used — a lower-privilege access that is still anomalous from a non-system process. This does NOT exploit anything — it only opens and immediately closes a handle.
Command
powershell.exe -Command "$sig = 'using System; using System.Runtime.InteropServices; public class Win32 { [DllImport(""kernel32.dll"")] public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId); [DllImport(""kernel32.dll"")] public static extern bool CloseHandle(IntPtr hObject); }'; Add-Type -TypeDefinition $sig; $p = Get-Process -Name MsMpEng -ErrorAction SilentlyContinue; if ($p) { $h = [Win32]::OpenProcess(0x0400, $false, $p.Id); if ($h -ne [IntPtr]::Zero) { Write-Host "Handle acquired: $h"; [Win32]::CloseHandle($h) | Out-Null } else { Write-Host 'OpenProcess failed (expected on protected process)' } } else { Write-Host 'MsMpEng not found' }"Expected Telemetry
Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe, GrantedAccess=0x0400. Note: Windows Defender is Protected Process Light (PPL) — the OpenProcess call may be denied, but Sysmon still logs the attempt with CallTrace data showing the call stack.
Expected Detection
SPL query EventCode=10 fires with TargetIsSecurity=1 and SourceTrusted=0. KQL DeviceEvents with ActionType=ProcessAccessed and FileName matching MsMpEng.exe fires the SecurityProcessAccess detection signal. Validates the process access detection path.
Queries the current state of Windows Defender service and simulates the pre-exploitation reconnaissance an adversary would perform before attempting to crash or exploit a security service. Uses sc.exe to query the service state — this is exactly what tools like Mimikatz and other post-exploitation frameworks do before targeting security software. Does NOT stop or modify the service.
Command
cmd.exe /c "sc query WinDefend && sc query Sense && sc query MdCoreSvc && wmic service where name='WinDefend' get Name,State,PathName && tasklist /FI "IMAGENAME eq MsMpEng.exe" /V"Expected Telemetry
Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'sc query WinDefend' and 'sc query Sense'. Security Event ID 4688 (if enabled). Sysmon Event ID 1 for wmic.exe with CommandLine containing 'service where name'. These are the same reconnaissance commands used by threat actors (including APT28 tooling) to identify security software before exploitation.
Expected Detection
This test validates the security software discovery detection (T1518.001) which typically precedes T1211. The sc.exe and wmic.exe process creation events should appear in hunting queries. In environments with T1518.001 detections deployed, alerts will fire on the service enumeration pattern.
Simulates the Windows Error Reporting artifacts generated when a security process crashes by invoking WerFault.exe with a dummy PID. This tests the detection and evidence collection paths for crash-based exploitation without actually crashing anything. Real exploitation of security software (e.g., heap overflow in AV engine parsing a malformed file) would generate the same WerFault invocation and Application Event ID 1000 entries.
Command
cmd.exe /c "werfault.exe -u -p 0 -s 64 2>nul & echo WerFault simulation complete & wevtutil qe Application /q:"*[System[Provider[@Name='Application Error'] and EventID=1000]]" /c:3 /f:text"Expected Telemetry
Sysmon Event ID 1: Process Create for werfault.exe with command line containing '-p 0'. Application Event Log queries via wevtutil generate additional Sysmon Event ID 1 entries for wevtutil.exe. The WerFault invocation with PID 0 will fail but the process creation telemetry is generated and matches patterns seen when security software is exploited and crashes.
Expected Detection
Sysmon EID 1 for WerFault.exe and wevtutil.exe appear in process creation logs. Validates that the evidence collection path (Application Event Log querying) is functioning. Correlate with the hunting query that joins security service events with subsequent suspicious process activity.