Detect Spoof Security Alerting in Splunk
Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders' awareness of malicious activity. Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Rather than or in addition to Indicator Blocking, an adversary can spoof positive affirmations that security tools are continuing to function even after legitimate security tools have been disabled. An adversary can also present a 'healthy' system status even after infection. For example, adversaries may show a fake Windows Security GUI and tray icon with a 'healthy' system status after Windows Defender and other system tools have been disabled. This technique was observed in Black Basta ransomware campaigns using custom EDR evasion tools tied to FIN7.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1685 Disable or Modify Tools
- Sub-technique
- T1685.003 Modify or Spoof Tool UI
- Canonical reference
- https://attack.mitre.org/techniques/T1685/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*SecurityHealthSystray.exe" OR Image="*SecurityHealthHost.exe" OR Image="*MSASCuiL.exe")
NOT (Image="C:\\Windows\\System32\\*" OR Image="C:\\Program Files\\Windows Defender\\*" OR Image="C:\\ProgramData\\Microsoft\\Windows Defender\\*")
| eval DetectionType="FakeSecurityProcess_WrongPath"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Hashes, DetectionType
| sort - _time
| append [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*sc stop WinDefend*" OR CommandLine="*sc stop SecurityHealthService*" OR CommandLine="*sc stop wscsvc*" OR CommandLine="*DisableRealtimeMonitoring*" OR CommandLine="*sc config WinDefend start= disabled*")
| eval DetectionType="DefenderServiceDisabled"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionType
| sort - _time
]
| append [
search index=wineventlog sourcetype="WinEventLog:System" EventCode=7036
(Message="*Windows Defender*" OR Message="*Security Center*" OR Message="*SecurityHealthService*")
Message="*stopped*"
| eval DetectionType="SecurityServiceStopped"
| table _time, host, Message, DetectionType
| sort - _time
]Detects security alerting spoofing using Sysmon and Windows System event logs. Monitors for (1) Security Health tray processes running from non-standard paths via Sysmon Event ID 1, (2) commands that disable Defender services (sc stop, Set-MpPreference), and (3) Windows System Event ID 7036 service state change notifications showing security services entering a stopped state. The multi-source approach catches both the spoofing and the preceding service disablement.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Third-party security tools that reference Windows Security strings in their command lines for integration
- Administrators legitimately stopping Defender during alternative AV product installation
- Windows servicing operations that temporarily stop and restart security services during feature updates
- Security product uninstallation workflows that stop services before removing binaries
Other platforms for T1685.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Fake SecurityHealthSystray from TEMP Directory
Expected signal: Sysmon Event ID 1: Process Create with Image pointing to %TEMP%\SecurityHealthSystray.exe instead of C:\Windows\System32\. Sysmon Event ID 11: File Create for the copied binary. DeviceProcessEvents in MDE shows FolderPath as the TEMP directory.
- Test 2 Disable Windows Defender Real-Time Monitoring
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Set-MpPreference -DisableRealtimeMonitoring'. PowerShell ScriptBlock Log Event ID 4104. Microsoft-Windows-Windows Defender/Operational Event ID 5001 (Real-Time Protection disabled). If Tamper Protection is on, Event ID 1125 (tamper attempt blocked).
- Test 3 Stop Windows Defender Service via sc.exe
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. If Tamper Protection is on, the command will fail with Access Denied.
References (4)
- https://attack.mitre.org/techniques/T1685/003/
- https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
- https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
- https://learn.microsoft.com/en-us/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection
Response Playbook
Triage
- Verify the actual state of Windows Defender and security services — run 'Get-MpComputerStatus' and 'Get-Service WinDefend, SecurityHealthService, wscsvc, Sense' to determine if the real security tools are running or have been disabled.
- Compare the detected process's file hash against known-good hashes for SecurityHealthSystray.exe and SecurityHealthHost.exe — use 'Get-FileHash' or VirusTotal to verify the binary is legitimate.
- Check the file path of the suspicious process — legitimate Windows Security processes run from C:\Windows\System32\ or C:\Program Files\Windows Defender\. Any other path is highly suspicious.
- Look for temporally correlated events — was a Defender service stopped or disabled shortly before the spoofed process appeared? This is the Black Basta/FIN7 pattern.
- Examine the parent process — who or what launched the fake security UI? If it was a recently dropped executable or a script, this strongly indicates malicious activity.
- Check if Windows Security Center (wscsvc) reports all security providers as healthy — an adversary may have registered a fake security provider.
Containment
- If a spoofed security UI is confirmed: immediately isolate the endpoint — the real security tools are likely disabled and the system is unprotected.
- Kill the fake security UI process and any associated parent processes — identify the full process tree and terminate all suspicious components.
- Re-enable Windows Defender: run 'Set-MpPreference -DisableRealtimeMonitoring $false' and restart the WinDefend service. If the service is set to disabled, change start type: 'sc config WinDefend start= auto'.
- Check for persistence mechanisms — the fake UI likely has a persistence entry (Run key, scheduled task, service) to restart after reboot. Remove these entries.
- Block the hash of the spoofed binary across all endpoints via EDR global block/quarantine rule.
- If this appears to be a Black Basta/FIN7 intrusion: activate your ransomware response plan immediately — encryption may follow shortly.
Evidence Collection
- Capture the spoofed binary — copy the fake SecurityHealthSystray.exe (or equivalent) from its non-standard path for malware analysis and hash submission to VT/YARA.
- Process Memory Dump — dump the fake security UI process memory for analysis of any embedded C2 URLs or ransomware staging code.
- Sysmon Event ID 1 — full process creation event for the fake UI process including hashes, parent process, and command line.
- Windows System Event ID 7036 — service state change events showing when WinDefend, SecurityHealthService, or wscsvc stopped.
- Windows Defender Operational Log — Microsoft-Windows-Windows Defender/Operational for events showing Defender being disabled or tampered with.
- Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce — check for persistence entries pointing to the fake security UI.
- Scheduled Tasks — export all scheduled tasks and look for entries that launch the spoofed binary.
Escalation Criteria
- !Confirmed fake security UI process running from a non-standard path with Windows Defender actually disabled — this is an active intrusion.
- !The spoofed process was deployed alongside service disablement commands — indicates a coordinated EDR evasion toolkit (Black Basta/FIN7 pattern).
- !Multiple endpoints showing the same fake security UI hash — indicates the tool is being deployed via lateral movement.
- !The process hash matches known FIN7/Black Basta EDR evasion tools or has low VirusTotal detection scores.
- !Evidence of additional post-exploitation activity (credential access, lateral movement, data staging) on the same endpoint.
Investigation Guide
Forensic Artifacts
- >
File System: The fake security UI binary at its non-standard path — capture for hash analysis and reverse engineering. - >
Registry: HKLM\SOFTWARE\Microsoft\Security Center\Provider\* — registered security providers, check for fake entries. - >
Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — persistence for the fake UI. - >
Event Log: Microsoft-Windows-Windows Defender/Operational — tamper protection events and service state changes. - >
Event Log: System Event ID 7036 — service started/stopped events for security services. - >
Event Log: System Event ID 7045 — new service installation events that may indicate fake security service registration. - >
Prefetch: C:\Windows\Prefetch\SECURITYHEALTHSYSTRAY.EXE-*.pf — execution history, check for execution from unexpected paths. - >
WMI: SecurityCenter2 namespace — query for registered AV products and their state to detect spoofed registrations.
Tuning Guidance
This detection benefits from a strong baseline of expected security process behavior. Start by documenting the exact file paths and SHA256 hashes of legitimate SecurityHealthSystray.exe, SecurityHealthHost.exe, and MSASCuiL.exe in your environment. Create an allowlist of these known-good path+hash combinations. For the service stop detection, build an allowlist of approved service accounts and processes that may legitimately manage Defender services (SCCM client, Intune management extension, IT deployment tools). Consider using Windows Defender Tamper Protection (managed via Intune) to prevent unauthorized Defender disablement — with Tamper Protection enabled, most spoofing prerequisites are blocked. If your organization uses a third-party AV that disables Windows Defender as part of its operation, exclude that vendor's management processes from the service stop detection.
Hunting Queries
Hunt for Windows Security tray processes executing from multiple different paths or from non-standard locations across the environment. Legitimate SecurityHealthSystray.exe should only run from C:\Windows\System32\. Any execution from other paths indicates either a spoofed binary or a relocated legitimate binary (both worth investigating).
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("SecurityHealthSystray.exe", "SecurityHealthHost.exe", "MSASCuiL.exe")
| summarize ExecutionCount=count(), Paths=make_set(FolderPath), Hashes=make_set(SHA256) by DeviceName
| where array_length(Paths) > 1 or Paths !has "System32"
| sort by ExecutionCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*SecurityHealthSystray.exe" OR Image="*SecurityHealthHost.exe" OR Image="*MSASCuiL.exe")
| stats count as ExecutionCount, values(Image) as Paths, values(Hashes) as Hashes by host
| where NOT match(Paths, "System32") OR mvcount(Paths) > 1
| sort - ExecutionCountHunt for the Black Basta/FIN7 kill chain: Defender service disabled followed by a fake security UI process appearing from a non-standard path within 24 hours. This temporal correlation is the defining pattern of security alerting spoofing — the adversary disables the real tool and replaces it with a fake.
let DefenderStops = DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("sc stop WinDefend", "sc stop SecurityHealthService", "Set-MpPreference -DisableRealtimeMonitoring")
| project StopTime=Timestamp, DeviceName, StopCommand=ProcessCommandLine;
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("SecurityHealthSystray.exe", "SecurityHealthHost.exe")
| where not(FolderPath startswith "C:\\Windows\\System32")
| join kind=inner (DefenderStops) on DeviceName
| where Timestamp > StopTime and datetime_diff('hour', Timestamp, StopTime) < 24
| project StopTime, Timestamp, DeviceName, StopCommand, FileName, FolderPathindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*sc stop WinDefend*" OR CommandLine="*sc stop SecurityHealthService*" OR CommandLine="*DisableRealtimeMonitoring*")
| rename _time as StopTime, host as StopHost
| join StopHost [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*SecurityHealthSystray.exe" OR Image="*SecurityHealthHost.exe") NOT Image="C:\\Windows\\System32\\*"
| rename _time as FakeUITime, host as StopHost
]
| where FakeUITime > StopTime
| eval HoursApart=round((FakeUITime - StopTime) / 3600, 1)
| where HoursApart < 24
| table StopTime, FakeUITime, StopHost, CommandLine, Image, HoursApartHunt for non-security processes that reference Windows Security component names in their command lines. This catches custom-built spoofing tools that create fake security interfaces using names like 'SecurityHealth' or 'Windows Defender' without being the actual Microsoft binaries.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("SecurityHealth", "Windows Defender", "MSASCuiL", "WindowsSecurity")
| where FileName !in~ ("SecurityHealthSystray.exe", "SecurityHealthHost.exe", "MSASCuiL.exe", "MsMpEng.exe", "svchost.exe", "services.exe", "mmc.exe", "taskmgr.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*SecurityHealth*" OR CommandLine="*Windows Defender*" OR CommandLine="*MSASCuiL*" OR CommandLine="*WindowsSecurity*")
NOT (Image="*SecurityHealthSystray.exe" OR Image="*SecurityHealthHost.exe" OR Image="*MSASCuiL.exe" OR Image="*MsMpEng.exe" OR Image="*svchost.exe" OR Image="*services.exe" OR Image="*mmc.exe")
| table _time, host, User, Image, CommandLine, Hashes
| sort - _timeAtomic Red Team Tests
Copies the legitimate SecurityHealthSystray.exe to a temporary directory and executes it from there, simulating an adversary deploying a lookalike security UI from a non-standard path. This tests the path-based detection logic without requiring a custom-built fake binary.
Command
copy "C:\Windows\System32\SecurityHealthSystray.exe" "%TEMP%\SecurityHealthSystray.exe" && "%TEMP%\SecurityHealthSystray.exe"Cleanup
taskkill /F /IM SecurityHealthSystray.exe 2>nul & del "%TEMP%\SecurityHealthSystray.exe"Expected Telemetry
Sysmon Event ID 1: Process Create with Image pointing to %TEMP%\SecurityHealthSystray.exe instead of C:\Windows\System32\. Sysmon Event ID 11: File Create for the copied binary. DeviceProcessEvents in MDE shows FolderPath as the TEMP directory.
Expected Detection
KQL: DeviceProcessEvents matches on FileName=SecurityHealthSystray.exe with FolderPath NOT starting with C:\Windows\System32. DetectionType=FakeSecurityProcess_WrongPath. SPL: Sysmon EventCode=1 with Image not matching the System32 path.
Uses Set-MpPreference to disable Windows Defender real-time monitoring, which is the first step an adversary takes before deploying a fake security UI. This command requires local administrator privileges. Tamper Protection (if enabled) will block this command.
Command
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true"Cleanup
powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $false"Expected Telemetry
Sysmon Event ID 1: Process Create with CommandLine containing 'Set-MpPreference -DisableRealtimeMonitoring'. PowerShell ScriptBlock Log Event ID 4104. Microsoft-Windows-Windows Defender/Operational Event ID 5001 (Real-Time Protection disabled). If Tamper Protection is on, Event ID 1125 (tamper attempt blocked).
Expected Detection
KQL: DeviceProcessEvents matches on ProcessCommandLine containing 'DisableRealtimeMonitoring'. DetectionType=DefenderServiceDisabled. SPL: Matched in DefenderServiceDisabled append block.
Uses sc.exe to stop the WinDefend (Windows Defender Antivirus Service) and SecurityHealthService. This is the direct service manipulation approach used by adversaries before deploying spoofed security UIs. Requires SYSTEM or administrator context.
Command
sc stop WinDefend & sc stop SecurityHealthServiceCleanup
sc start WinDefend & sc start SecurityHealthServiceExpected Telemetry
Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. If Tamper Protection is on, the command will fail with Access Denied.
Expected Detection
KQL: DeviceProcessEvents matches on ProcessCommandLine containing 'sc stop WinDefend'. DetectionType=DefenderServiceDisabled. SPL: Matched in DefenderServiceDisabled append block and SecurityServiceStopped System log block.