T1668

Exclusive Control

Persistence Last updated:

This detection identifies adversary behaviors consistent with T1668 Exclusive Control, where a threat actor attempts to maintain sole access to a compromised system by eliminating competition. Detection focuses on four primary behavioral clusters: (1) disabling vulnerable services via sc.exe or net.exe by non-standard parent processes, (2) adding inbound-blocking firewall rules via netsh.exe outside of legitimate administrative context, (3) mass process termination targeting known malware or cryptominer process names suggestive of competitor eviction, and (4) privilege stripping from local administrator accounts to prevent other actors from using those credentials. These behaviors are particularly associated with ransomware groups, initial access brokers protecting their footholds, and cryptomining malware that aggressively kills competing miners.

What is T1668 Exclusive Control?

Exclusive Control (T1668) maps to the Persistence tactic — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Exclusive Control, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Persistence
Technique
T1668 Exclusive Control
Canonical reference
https://attack.mitre.org/techniques/T1668/
Microsoft Sentinel / Defender
kusto 
let lookback = 24h;
let ExclusiveControlBehaviors =
// Pattern 1: Disabling vulnerable/competitor-used services by non-standard processes
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe")
| where ProcessCommandLine has_any ("disable", "stop", "delete")
| where ProcessCommandLine has_any ("RemoteRegistry", "RemoteAccess", "RDP", "TermService", "wuauserv", "WinRM", "snmp", "telnet", "IISADMIN", "W3SVC", "SMB")
| where not(InitiatingProcessFileName in~ ("msiexec.exe", "TiWorker.exe", "TrustedInstaller.exe", "svchost.exe", "services.exe", "MpCmdRun.exe"))
| extend DetectionType = "ServiceDisable"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DetectionType;
union
(
// Pattern 2: Inbound blocking firewall rules added by non-standard processes
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "add rule" and ProcessCommandLine has_any ("dir=in", "direction=in") and ProcessCommandLine has "block"
| where not(InitiatingProcessFileName in~ ("msiexec.exe", "svchost.exe", "setup.exe", "WindowsDefender.exe", "MsMpEng.exe"))
| extend DetectionType = "FirewallInboundBlock"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DetectionType
),
(
// Pattern 3: Process termination targeting known cryptominer or competitor malware names
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("taskkill.exe", "tskill.exe", "kill.exe")
| where ProcessCommandLine has_any ("xmrig", "minerd", "cryptonight", "kinsing", "watchbog", "kthreaddi", "sysupdates", "update.sh", "networkmanager", "nssm", "sysrv", "masscan", "kerberods")
| extend DetectionType = "CompetitorMalwareKill"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DetectionType
),
(
// Pattern 4: Privilege stripping — removing accounts from Administrators group
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has "localgroup" and ProcessCommandLine has "Administrators" and ProcessCommandLine has "/delete"
| where not(InitiatingProcessFileName in~ ("msiexec.exe", "dsregcmd.exe", "UserAccountControlSettings.exe"))
| extend DetectionType = "PrivilegeStripping"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DetectionType
);
ExclusiveControlBehaviors
| summarize
    EventCount = count(),
    DetectionTypes = make_set(DetectionType),
    Commands = make_set(ProcessCommandLine),
    ParentProcesses = make_set(InitiatingProcessFileName),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by DeviceName, AccountName, bin(TimeGenerated, 1h)
| extend RiskScore = case(
    array_length(DetectionTypes) >= 2, "High",
    DetectionTypes has "CompetitorMalwareKill", "High",
    DetectionTypes has "PrivilegeStripping", "High",
    DetectionTypes has "FirewallInboundBlock", "Medium",
    "Low"
)
| where RiskScore in ("High", "Medium")
| project LastSeen, FirstSeen, DeviceName, AccountName, DetectionTypes, Commands, ParentProcesses, EventCount, RiskScore
| order by LastSeen desc

Detects four behavioral clusters associated with T1668 Exclusive Control: (1) disabling vulnerable services (RemoteRegistry, RDP, WinRM, SMB) via sc.exe/net.exe outside legitimate admin contexts, (2) adding inbound-blocking firewall rules via netsh.exe by non-standard parent processes, (3) taskkill targeting known cryptominer and competing malware process names, and (4) removal of accounts from the local Administrators group to prevent credential reuse by competitors. Results are aggregated per host/hour with a risk score elevated when multiple patterns co-occur.

high severity medium confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate IT hardening scripts that disable unused services (RemoteRegistry, Telnet, SNMP) as part of CIS benchmark compliance
  • Security team firewall automation adding inbound block rules for known malicious IPs or ports as part of incident response
  • Endpoint security products (EDR, AV) that terminate known malicious processes during active remediation scans
  • Help desk administrators removing terminated employees from the local Administrators group during offboarding workflows
  • Patch management systems that stop services prior to applying Windows updates

Sigma rule & cross-platform mapping

The detection logic for Exclusive Control (T1668) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1668 Sigma rules on detection.fyi

Platform-specific guides for T1668

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-03-20 Research depth: deep
References (3)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Service Disable via sc.exe (Simulating Exclusive Control of Entry Vector)

    Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinRM' and 'config WinRM start= disabled'. Windows Event ID 7036: WinRM service entered stopped state. Windows Event ID 7040: Start type of WinRM service changed from auto to disabled.

  2. Test 2Inbound Firewall Block Rule Addition (Simulating Port Blocking for Competitor Lockout)

    Expected signal: Sysmon Event ID 1: netsh.exe with CommandLine containing 'add rule', 'dir=in', 'action=block'. Windows Firewall audit log entry showing new inbound DROP rule creation.

  3. Test 3Simulated Competitor Process Termination (Cryptominer Name)

    Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine '/f /im xmrig.exe'. Sysmon Event ID 5 (ProcessTerminate) for the xmrig.exe process. Parent process of taskkill.exe will be cmd.exe.

  4. Test 4Privilege Stripping — Remove Account from Local Administrators

    Expected signal: Sysmon Event ID 1 for net.exe with CommandLine 'localgroup Administrators AtomicTestUser /delete'. Windows Security Event ID 4733 (member removed from security-enabled local group). Security Event ID 4720 and 4726 for account creation and deletion.

Response Playbook

Triage

  1. Step 1: Identify the initiating process for each alert. Open the raw Sysmon Event ID 1 log and inspect ParentImage, ParentCommandLine, and ParentProcessId. Determine whether the parent is a known admin tool (e.g., cmd.exe, powershell.exe launched by a human) or an unexpected background process (e.g., a web server child, a temp-directory binary).
  2. Step 2: Cross-reference the account executing the commands. Run a LogonEvents query (Event ID 4624/4648) for the same host/time window to determine if the account logged on interactively, via network share, or via a service. Logons from unusual source IPs, at unusual hours, or using credentials inconsistent with the account's normal behavior are a strong signal.
  3. Step 3: For 'CompetitorMalwareKill' patterns, check whether the process being killed actually exists or existed on the host. Query DeviceProcessEvents for process names matching the terminated target in the prior 48 hours. If a cryptominer or RAT was running and then killed by an unknown process, this strongly indicates competitor eviction.
  4. Step 4: For 'ServiceDisable' patterns, identify which service was stopped/disabled and whether it was previously in a running state. Use DeviceEvents or SecurityEvent 7036 (Service state change) to verify the service was running before the command. Correlate with CVE advisories to determine if the disabled service had a known exploited vulnerability.
  5. Step 5: For 'FirewallInboundBlock' patterns, decode the full netsh command to identify which port or IP range is being blocked. Determine if the blocked port matches the entry vector used by the suspected attacker (e.g., blocking TCP/445 after exploiting EternalBlue, blocking TCP/3389 after RDP brute force).
  6. Step 6: For 'PrivilegeStripping' patterns, identify which account was removed from Administrators and whether that account is associated with a known threat actor backdoor, a default service account, or a legitimate user. Check if the removed account had recent suspicious activity (lateral movement, data access).
  7. Step 7: Check for concurrent persistence mechanisms. Query for new scheduled tasks (DeviceProcessEvents for schtasks.exe), registry autorun modifications (DeviceRegistryEvents for Run/RunOnce keys), and new services (Security Event 7045/4697) within a 2-hour window around the exclusive control behavior. Adversaries 'closing the door' typically do so after establishing their own persistence.

Containment

  1. Isolate the affected endpoint from the network via EDR console or manual network quarantine. Preserve network isolation before proceeding — the adversary may be actively monitoring for competitor access attempts.
  2. Do not immediately re-enable disabled services or restore firewall rules until forensic imaging is complete. These changes are evidence and may be relevant to attribution.
  3. If a compromised account was identified as the actor, disable the account in Active Directory immediately and revoke all active sessions. Coordinate with identity team to reset credentials for all accounts that may have been observed or stolen on this host.
  4. If competitor malware was killed but evidence of the original adversary's implant remains, prioritize capturing a memory dump before any AV remediation scan can destroy volatile indicators.
  5. Block outbound C2 communication by identifying network connections made by the suspicious initiating process in DeviceNetworkEvents and sinkholing or blocking destination IPs/domains at the perimeter firewall.

Evidence Collection

  1. Collect a full memory dump from the affected host using WinPmem or a built-in EDR memory acquisition feature. Volatile indicators of the adversary's implant (injected shellcode, decrypted C2 config) will not survive a reboot.
  2. Export Windows Event Logs: Security (4624, 4625, 4648, 4688, 4697, 4698, 7034, 7036, 7045), System, Sysmon Operational, and PowerShell Operational logs for the 72-hour window preceding the alert.
  3. Capture a disk image or forensic triage package (using KAPE or similar) targeting prefetch files (C:\Windows\Prefetch\), Shimcache (SYSTEM hive HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache), AmCache (C:\Windows\AppCompat\Programs\Amcache.hve), and MFT metadata to reconstruct binary execution timeline.
  4. Collect netstat output, active TCP connections, and routing table at the time of isolation if live response is available. Document all established and listening connections before network quarantine.
  5. Extract the Windows Firewall configuration (netsh advfirewall export <path>) to document the full ruleset including adversary-added block rules.
  6. If the competitor malware kill pattern fired, collect any remaining artifacts of the killed process from disk (C:\Users\<user>\AppData, C:\ProgramData, temp directories) before AV cleanup removes them. Hash and preserve for threat intelligence comparison.
  7. Collect scheduled tasks (schtasks /query /fo LIST /v > tasks.txt), services (sc query type= all state= all), and startup entries (reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) to identify adversary persistence.

Escalation Criteria

  • ! Escalate immediately to Tier 3/IR if lateral movement indicators are found: DeviceLogonEvents showing the same account or NTLM hash used to authenticate to other internal hosts within the same time window.
  • ! Escalate if a known ransomware precursor pattern is identified — exclusive control combined with shadow copy deletion (vssadmin, wmic shadowcopy delete), AV/EDR disablement, or mass file encryption activity.
  • ! Escalate if the adversary's implant appears to have been running for more than 24 hours before exclusive control behavior was triggered, indicating an established foothold rather than an opportunistic scan.
  • ! Escalate if the attack appears to target critical infrastructure systems (domain controllers, Tier 0 servers, OT/SCADA-adjacent hosts), as exclusive control in these environments may indicate a pre-ransomware or destructive attack preparation.
  • ! Escalate if two or more hosts show the same exclusive control behavior pattern within a short window — this suggests automated tooling consistent with a ransomware affiliate or cryptomining botnet performing network-wide competitor eviction.

Investigation Guide

Forensic Artifacts

  • > Windows Event ID 7036 (Service Control Manager) — service state change records showing services stopped or disabled
  • > Windows Event ID 7045/4697 — new services registered by the adversary to maintain their own access
  • > Windows Firewall log (C:\Windows\System32\LogFiles\Firewall\pfirewall.log) — inbound blocked connections following adversary firewall rule addition
  • > Prefetch files for sc.exe, net.exe, taskkill.exe, netsh.exe — execution timestamps and loaded libraries confirming binary usage
  • > Sysmon Event ID 13 (RegistryValueSet) — registry modifications to service ImagePath or Start values indicating service tampering
  • > AmCache hive entries for short-lived executables that may represent competitor malware killed before persistence was established
  • > MFT metadata showing file creation timestamps for new adversary implants alongside deletion timestamps of competitor malware files
  • > Windows Firewall exported configuration (via netsh) showing adversary-added inbound block rules with creation timestamps
  • > Security Event 4732 (member added to security-enabled local group) and 4733 (member removed) — account membership changes
  • > Linux: /var/log/auth.log or /var/log/secure for privilege modification events; crontab changes via /var/spool/cron; iptables/nftables rule additions in /etc/iptables/rules.v4

Tuning Guidance

Start by building an allowlist of legitimate parent processes for sc.exe, net.exe, and netsh.exe in your environment. SCCM, Intune, Ansible, and patch management solutions will regularly appear as parents. Suppress these by parent process hash or signed binary path. For the 'CompetitorMalwareKill' detection, tune the keyword list to match mining tools and RAT names observed in your threat intelligence feeds — the default list targets common cryptominers. Expect the firewall block detection to fire during IR containment activities; add a suppression for accounts in your IR team's privileged group. On Linux environments, ensure your Syslog ingestion captures kernel messages from iptables, otherwise the Linux hunting query will return no results. Review alerts weekly for the first month and build environment-specific exclusions before reducing the lookback window or raising the severity.

Hunting Queries

Hunts for bulk file deletion of executables from user-writable paths by non-AV processes, which may indicate an adversary removing competitor malware implants from persistence locations.

Hunting — KQL
kql 
// Hunt: Detect file deletion patterns targeting known malware persistence locations by unexpected processes
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType == "FileDeleted"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\")
| where FileName has_any (".exe", ".dll", ".bat", ".ps1", ".vbs", ".sh")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "MpCmdRun.exe", "SenseIR.exe", "msiexec.exe", "TrustedInstaller.exe", "explorer.exe")
| summarize
    FilesDeleted = count(),
    DeletedFiles = make_set(FileName),
    DeletionPaths = make_set(FolderPath)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| where FilesDeleted >= 3
| order by FilesDeleted desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=23
| where TargetFilename LIKE "%.exe" OR TargetFilename LIKE "%.dll" OR TargetFilename LIKE "%.bat" OR TargetFilename LIKE "%.ps1"
| where TargetFilename LIKE "%\\Temp\\%" OR TargetFilename LIKE "%\\AppData\\%" OR TargetFilename LIKE "%\\ProgramData\\%" OR TargetFilename LIKE "%\\Users\\Public\\%"
| where NOT (Image LIKE "%MsMpEng%" OR Image LIKE "%MpCmdRun%" OR Image LIKE "%msiexec%")
| stats count as delete_count, values(TargetFilename) as deleted_files by host, Image, CommandLine
| where delete_count >= 3
| sort - delete_count

Hunts for Linux-side exclusive control where adversaries add iptables/nftables DROP rules on ports commonly used for remote access (SSH, RDP, SMB, WinRM) or known RAT ports. Complements the Windows-focused main detection.

Hunting — KQL
kql 
// Hunt: Detect iptables/nftables exclusive control on Linux via AuditLogs or Syslog
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "kern" or ProcessName in ("iptables", "nft", "ufw")
| where SyslogMessage has_any ("DROP", "REJECT", "--dport", "INPUT", "chain input")
| where SyslogMessage has_any ("22", "3389", "445", "5985", "4444", "1337", "31337")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype="linux_secure" OR sourcetype="syslog"
| search ("iptables" OR "nft" OR "ufw") AND ("DROP" OR "REJECT") AND ("INPUT" OR "--dport")
| rex field=_raw "--dport\s+(?P<blocked_port>\d+)"
| where isnotnull(blocked_port)
| eval is_suspicious_port = case(blocked_port IN ("22","3389","445","5985","4444","1337","31337","6667","23","21"), "yes", 1=1, "no")
| where is_suspicious_port="yes"
| stats count by host, blocked_port, _time
| sort - _time

Hunts for the adversary swap pattern: a new service registered with a path in a user-writable temp location (adversary implant) followed within 2 hours by a different service being set to Start=Disabled (competitor or defender service shut down). This correlation strongly indicates deliberate exclusive control rather than routine maintenance.

Hunting — KQL
kql 
// Hunt: Detect sc.exe config changes to Start type (disabled) correlated with recently created services suggesting adversary persistence swap
let NewServices = DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName == "ImagePath"
| where RegistryValueData has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
| extend ServiceName = extract(@"Services\\([^\\]+)\\", 1, RegistryKey)
| project TimeGenerated, DeviceName, ServiceName, RegistryValueData;
let DisabledServices = DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
| where RegistryValueName == "Start" and RegistryValueData == "4"
| extend ServiceName = extract(@"Services\\([^\\]+)\\", 1, RegistryKey)
| project TimeGenerated, DeviceName, ServiceName;
NewServices
| join kind=inner DisabledServices on DeviceName
| where TimeGenerated1 between (TimeGenerated .. (TimeGenerated + 2h))
| where ServiceName != ServiceName1
| project TimeGenerated, DeviceName, NewServiceName = ServiceName, NewServicePath = RegistryValueData, DisabledServiceName = ServiceName1
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| eval reg_key_lower = lower(TargetObject)
| where reg_key_lower LIKE "%currentcontrolset\\services%"
| eval value_name = mvindex(split(TargetObject, "\\"), -1)
| where value_name="Start" AND Details="DWORD (0x00000004)"
| eval service_name = mvindex(split(TargetObject, "\\"), -2)
| stats count, values(service_name) as disabled_services, max(_time) as last_seen by host
| join host
    [search index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
    | where TargetObject LIKE "%currentcontrolset\\services%" AND TargetObject LIKE "%ImagePath%"
    | where Details LIKE "%Temp%" OR Details LIKE "%AppData%" OR Details LIKE "%ProgramData%"
    | stats values(Details) as suspicious_service_paths by host]
| table last_seen, host, disabled_services, suspicious_service_paths
| sort - last_seen

Atomic Red Team Tests

Test 1 Service Disable via sc.exe (Simulating Exclusive Control of Entry Vector)
windows

Simulates an adversary disabling a vulnerable/competitor-used service (WinRM) to prevent other threat actors from using the same remote access vector. Uses a non-privileged parent process context for higher fidelity.

Command

powershell 
sc.exe stop WinRM
sc.exe config WinRM start= disabled
echo [*] WinRM service stopped and disabled
sc.exe query WinRM

Cleanup

powershell 
sc.exe config WinRM start= auto
sc.exe start WinRM
echo [*] WinRM service restored

Expected Telemetry

Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinRM' and 'config WinRM start= disabled'. Windows Event ID 7036: WinRM service entered stopped state. Windows Event ID 7040: Start type of WinRM service changed from auto to disabled.

Expected Detection

Alert fires on 'ServiceDisable' pattern detecting sc.exe disabling WinRM with a non-standard parent process.

Test 2 Inbound Firewall Block Rule Addition (Simulating Port Blocking for Competitor Lockout)
windows

Simulates an adversary adding a Windows Firewall rule to block inbound SMB (TCP 445) to prevent other threat actors from using the same protocol-based entry vector (e.g., post-EternalBlue exploitation).

Command

powershell 
netsh advfirewall firewall add rule name="AtomicTest-ExclusiveControl-BlockSMB" dir=in action=block protocol=tcp localport=445
echo [*] Inbound block rule added for port 445
netsh advfirewall firewall show rule name="AtomicTest-ExclusiveControl-BlockSMB"

Cleanup

powershell 
netsh advfirewall firewall delete rule name="AtomicTest-ExclusiveControl-BlockSMB"
echo [*] Test firewall rule removed

Expected Telemetry

Sysmon Event ID 1: netsh.exe with CommandLine containing 'add rule', 'dir=in', 'action=block'. Windows Firewall audit log entry showing new inbound DROP rule creation.

Expected Detection

Alert fires on 'FirewallInboundBlock' pattern detecting netsh.exe adding an inbound block rule outside of svchost/msiexec parent context.

Test 3 Simulated Competitor Process Termination (Cryptominer Name)
windows

Simulates an adversary killing a running cryptominer (competitor malware) by name using taskkill. Uses a dummy process named to match common miner names. This tests detection of the CompetitorMalwareKill pattern without actually running malware.

Command

powershell 
cmd.exe /c "start /b cmd.exe /c pause" & timeout /t 2
wmic process where "name='cmd.exe'" get processid /value
REM Simulate miner kill by naming a test process xmrig and then killing it
copy %SystemRoot%\System32\notepad.exe %TEMP%\xmrig.exe
start %TEMP%\xmrig.exe
timeout /t 2
taskkill /f /im xmrig.exe
echo [*] Simulated cryptominer process terminated

Cleanup

powershell 
del /f %TEMP%\xmrig.exe 2>nul
echo [*] Test binary removed

Expected Telemetry

Sysmon Event ID 1: taskkill.exe with CommandLine '/f /im xmrig.exe'. Sysmon Event ID 5 (ProcessTerminate) for the xmrig.exe process. Parent process of taskkill.exe will be cmd.exe.

Expected Detection

Alert fires on 'CompetitorMalwareKill' pattern detecting taskkill.exe targeting 'xmrig' in the process name argument.

Test 4 Privilege Stripping — Remove Account from Local Administrators
windows

Simulates an adversary removing a backdoor or competitor-controlled account from the local Administrators group to prevent credential reuse and maintain exclusive administrative access.

Command

powershell 
net user AtomicTestUser AtomicP@ssw0rd123! /add
net localgroup Administrators AtomicTestUser /add
echo [*] Test account created and added to Administrators
timeout /t 2
net localgroup Administrators AtomicTestUser /delete
echo [*] Account removed from Administrators (privilege stripping simulated)

Cleanup

powershell 
net user AtomicTestUser /delete 2>nul
echo [*] Test account deleted

Expected Telemetry

Sysmon Event ID 1 for net.exe with CommandLine 'localgroup Administrators AtomicTestUser /delete'. Windows Security Event ID 4733 (member removed from security-enabled local group). Security Event ID 4720 and 4726 for account creation and deletion.

Expected Detection

Alert fires on 'PrivilegeStripping' pattern detecting net.exe removing an account from the local Administrators group outside of a legitimate management process context.

Related Detections

Tactic Hub

TA0003Persistence

Related Techniques

T1053.005Scheduled TaskT1543Create or Modify System ProcessT1133External Remote ServicesT1556.003Pluggable Authentication ModulesT1546.013PowerShell ProfileT1205.002Socket FiltersT1574.007Path Interception by PATH Environment VariableT1496Resource HijackingT1485Data Destruction

Same Tactic: Persistence

Popular Detections