Detect Disable or Modify Tools in Google Chronicle

rule t1562_001_disable_security_tools {
  meta:
    author = "Argus Detection Platform"
    description = "Detects attempts to disable or modify security tools including AV/EDR services, processes, and Defender policies (T1562.001)"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562.001"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"

    (
      // Service control against security services
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\sc\.exe|\\net\.exe|\\net1\.exe)$`)
        and re.regex($e.target.process.command_line, `(?i)(stop|delete|config)`)
        and re.regex($e.target.process.command_line, `(?i)(windefend|sense|msmpsvc|wdnissvc|securityhealth|wscsvc|crowdstrike|csfalcon|cylance|cbdefense|sentinelagent|taniumclient)`)
      )
      or
      // Taskkill targeting security tool processes
      (
        re.regex($e.principal.process.file.full_path, `(?i)\\taskkill\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(msmpeng|mssense|csfalcon|cylancesvc|cbdefense|sentinelagent|taniumclient|securityhealth|sentinelservicehost|tmabc|coreserviceshell)`)
      )
      or
      // PowerShell Defender policy modification
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\powershell\.exe|\\pwsh\.exe)$`)
        and re.regex($e.target.process.command_line, `(?i)(set-mppreference|add-mppreference)`)
        and re.regex($e.target.process.command_line, `(?i)(disablerealtimemonitoring|disablebehaviormonitoring|disableioavprotection|disablescriptscanning|exclusionpath|exclusionprocess|disableblockatfirstseen|disableantispyware)`)
      )
    )

  condition:
    $e
}