Detect Impair Defenses in Google Chronicle

rule t1562_impair_defenses {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1562 Impair Defenses - adversaries modifying or disabling security tools, audit logging, and defensive mechanisms"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.target.process.command_line, `(?i)(sc\s+(stop|config)|net\s+stop|taskkill).{0,100}(WinDefend|Sense|MsMpSvc|SecurityHealth|SecurityHealthService|EventLog|MpsSvc|WdNisSvc)`)
        or re.regex($e.target.process.command_line, `(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl\s)`)
        or re.regex($e.target.process.command_line, `(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring|Remove-MpPreference)`)
        or re.regex($e.target.process.command_line, `(?i)(bcdedit\s+/set.{0,40}safeboot|netsh\s+advfirewall\s+set)`)
        or re.regex($e.target.process.command_line, `(?i)taskkill.{0,60}(MsMpEng|NisSrv|SecurityHealth|MpCmdRun)`)
      )
    )
    or
    (
      $e.metadata.event_type = "REGISTRY_MODIFICATION"
      and (
        re.regex($e.target.registry.registry_key, `(?i).*(WinDefend|EventLog|SecurityHealth|MpsSvc|MsMpSvc).*`)
      )
    )
    or
    (
      $e.metadata.event_type = "USER_RESOURCE_ACCESS"
      and $e.metadata.product_event_type = "1102"
    )
    or
    (
      $e.metadata.event_type = "AUDIT_LOG_UPDATED"
      and $e.metadata.product_event_type = "4719"
    )

  condition:
    $e
}