Detect Exclusive Control in IBM QRadar
This detection identifies adversary behaviors consistent with T1668 Exclusive Control, where a threat actor attempts to maintain sole access to a compromised system by eliminating competition. Detection focuses on four primary behavioral clusters: (1) disabling vulnerable services via sc.exe or net.exe by non-standard parent processes, (2) adding inbound-blocking firewall rules via netsh.exe outside of legitimate administrative context, (3) mass process termination targeting known malware or cryptominer process names suggestive of competitor eviction, and (4) privilege stripping from local administrator accounts to prevent other actors from using those credentials. These behaviors are particularly associated with ransomware groups, initial access brokers protecting their footholds, and cryptomining malware that aggressively kills competing miners.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1668 Exclusive Control
- Canonical reference
- https://attack.mitre.org/techniques/T1668/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
"username" AS AccountName,
"CommandLine" AS CommandLine,
"ParentProcessName" AS ParentProcess,
"NewProcessName" AS ProcessName,
CASE
WHEN "CommandLine" ILIKE '%powershell%' AND "CommandLine" ILIKE '%-enc%' THEN 'EncodedCommand'
WHEN "CommandLine" ILIKE '%bypass%' THEN 'ExecutionBypass'
WHEN "CommandLine" ILIKE '%-noprofile%' THEN 'NoProfileExecution'
ELSE 'SuspiciousProcess'
END AS DetectionType,
CASE
WHEN "username" = 'SYSTEM' THEN 70
WHEN "CommandLine" ILIKE '%bypass%' THEN 85
ELSE 60
END AS RiskScore
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
AND eventid IN (4688, 1)
AND ("NewProcessName" ILIKE '%powershell.exe%'
OR "NewProcessName" ILIKE '%cmd.exe%'
OR "NewProcessName" ILIKE '%wscript.exe%'
OR "NewProcessName" ILIKE '%cscript.exe%'
OR "NewProcessName" ILIKE '%mshta.exe%')
AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURSIBM QRadar AQL detection for Exclusive Control (T1668). Queries QRadar event pipeline for indicators consistent with exclusive control adversary techniques using MITRE ATT&CK-aligned event categorization.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT hardening scripts that disable unused services (RemoteRegistry, Telnet, SNMP) as part of CIS benchmark compliance
- Security team firewall automation adding inbound block rules for known malicious IPs or ports as part of incident response
- Endpoint security products (EDR, AV) that terminate known malicious processes during active remediation scans
Other platforms for T1668
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Service Disable via sc.exe (Simulating Exclusive Control of Entry Vector)
Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinRM' and 'config WinRM start= disabled'. Windows Event ID 7036: WinRM service entered stopped state. Windows Event ID 7040: Start type of WinRM service changed from auto to disabled.
- Test 2Inbound Firewall Block Rule Addition (Simulating Port Blocking for Competitor Lockout)
Expected signal: Sysmon Event ID 1: netsh.exe with CommandLine containing 'add rule', 'dir=in', 'action=block'. Windows Firewall audit log entry showing new inbound DROP rule creation.
- Test 3Simulated Competitor Process Termination (Cryptominer Name)
Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine '/f /im xmrig.exe'. Sysmon Event ID 5 (ProcessTerminate) for the xmrig.exe process. Parent process of taskkill.exe will be cmd.exe.
- Test 4Privilege Stripping — Remove Account from Local Administrators
Expected signal: Sysmon Event ID 1 for net.exe with CommandLine 'localgroup Administrators AtomicTestUser /delete'. Windows Security Event ID 4733 (member removed from security-enabled local group). Security Event ID 4720 and 4726 for account creation and deletion.
References (6)
- https://attack.mitre.org/techniques/T1668/
- https://www.mandiant.com/resources/blog/initial-access-brokers-and-the-underground-economy
- https://news.sophos.com/en-us/2023/03/09/multiple-attackers-a-blessing-or-a-curse/
- https://www.aquasec.com/blog/threat-alert-new-campaign-against-postgres-databases/
- https://cert.at/en/warnungen/2025/1/fortinet-ransomware-angreifer-missbrauchen-cve-2024-55591
- https://www.f-secure.com/v-descs/netsky.shtml
Unlock Pro Content
Get the full detection package for T1668 including response playbook, investigation guide, and atomic red team tests.