Detect Spoof Security Alerting in Google Chronicle

rule t1562_011_spoof_security_alerting {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1562.011 Spoof Security Alerting — fake Windows Security GUIs and Defender service disablement. Observed in Black Basta ransomware via FIN7-linked EDR evasion tools."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562.011"
    severity = "CRITICAL"
    priority = "HIGH"
    created = "2026-04-21"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        (
          (
            re.regex($e.target.process.file.full_path, `(?i)(SecurityHealthSystray\.exe|SecurityHealthHost\.exe|MSASCuiL\.exe|NisSrv\.exe)$`)
          )
          and not (
            re.regex($e.target.process.file.full_path, `(?i)^C:\\Windows\\System32\\`) or
            re.regex($e.target.process.file.full_path, `(?i)^C:\\Program Files\\Windows Defender\\`) or
            re.regex($e.target.process.file.full_path, `(?i)^C:\\ProgramData\\Microsoft\\Windows Defender\\'`)
          )
        ) or
        (
          re.regex($e.target.process.command_line, `(?i)(SecurityHealth|Windows Defender|WindowsSecurity)`) and
          not re.regex($e.target.process.file.full_path, `(?i)(SecurityHealthSystray\.exe|SecurityHealthHost\.exe|MSASCuiL\.exe|NisSrv\.exe|MsMpEng\.exe|svchost\.exe|services\.exe)$`)
        ) or
        (
          re.regex($e.target.process.command_line, `(?i)(sc stop WinDefend|sc stop SecurityHealthService|sc stop wscsvc|DisableRealtimeMonitoring|sc config WinDefend start= disabled)`)
        )
      )
    )

  condition:
    $e
}