SASE and Endpoint Agent Tampering by an Employee

Each row is a service-control, kill or agent command that names a SASE or endpoint agent, outside the IT-support accounts.

// Replace the placeholder with IT-support accounts, and add your own agent's service and process names to AgentRegex.
let ITSupportAccounts = dynamic(["svc-it-support"]);
let Tools = dynamic(["sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "launchctl", "killall", "pkill", "kill", "mdatp", "falconctl"]);
let AgentRegex = @"(?i)(zsatunnel|zsaservice|zscaler|zsatray|stagentsvc|stagentui|nsservice|netskope|sentinelagent|cselement|csfalconservice|cbdefense|mssense|fresno|wdavdaemon|falcond|falconctl|mdatp)";
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ (Tools)
| where ProcessCommandLine matches regex AgentRegex
// optional: delete and remove also match ordinary uninstall and clean-up commands
| where ProcessCommandLine matches regex @"(?i)(stop|disable|kill|unload|bootout|delete|remove)"
| where AccountName !in~ (ITSupportAccounts)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessAccountName
| sort by Timestamp desc

Each row is a service-control, kill or agent command that names a SASE or endpoint agent, outside the IT-support accounts.

```sourcetype placeholders: index=endpoint with Sysmon or EDR process events (process_name, process, parent_process_name, host, user)```
```replace the placeholder with IT-support accounts, and add your own agent's service and process names to the second regex```
index=endpoint earliest=-30d process_name IN ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "launchctl", "killall", "pkill", "kill", "mdatp", "falconctl")
| regex process="(?i)(zsatunnel|zsaservice|zscaler|zsatray|stagentsvc|stagentui|nsservice|netskope|sentinelagent|cselement|csfalconservice|cbdefense|mssense|fresno|wdavdaemon|falcond|falconctl|mdatp)"
```optional: delete and remove also match ordinary uninstall and clean-up commands```
| regex process="(?i)(stop|disable|kill|unload|bootout|delete|remove)"
| search NOT user IN ("svc-it-support")
| table _time, host, user, process_name, parent_process_name, process
| sort 0 - _time

A single service-control, kill or agent command that names a SASE or endpoint agent, level high because it is rare.

title: SASE or Endpoint Agent Stopped or Disabled from an Employee Session
id: 9e2d4a71-3c85-4b06-b1f9-60a7d3c8e5f2
status: experimental
description: >
  Detects service-control, process-kill or agent command-line tools aimed at
  SASE and endpoint security agents on Windows and macOS. DTEX observed Zscaler
  and Netskope agents being disabled in DPRK IT-worker cases and rates the
  indicator low-recall, high-precision: rare, and meaningful when it occurs.
references:
  - https://www.dtex.ai/resources/i3-threat-advisory-inside-the-dprk/
  - https://attack.mitre.org/techniques/T1562/001/
logsource:
  category: process_creation
detection:
  selection_tool:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\taskkill.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wmic.exe'
      - '/launchctl'
      - '/killall'
      - '/pkill'
      - '/kill'
      - '/mdatp'
      - '/falconctl'
  selection_verb:
    CommandLine|contains:
      - 'stop'
      - 'disable'
      - 'kill'
      - 'unload'
      - 'bootout'
      # optional: also matches ordinary uninstall and clean-up commands
      - 'delete'
      - 'remove'
  selection_agent:
    CommandLine|contains:
      - 'zsatunnel'
      - 'zsaservice'
      - 'zscaler'
      - 'zsatray'
      - 'stagentsvc'
      - 'stagentui'
      - 'nsservice'
      - 'netskope'
      - 'sentinelagent'
      - 'cselement'
      - 'csfalconservice'
      - 'cbdefense'
      - 'mssense'
      - 'fresno'
      - 'wdavdaemon'
      - 'falcond'
      - 'falconctl'
      - 'mdatp'
  condition: selection_tool and selection_verb and selection_agent
falsepositives:
  - Sanctioned IT support troubleshooting connectivity, which should be correlated against an open ticket
level: high

Each row is a service-control, kill or agent command that names a SASE or endpoint agent, outside the IT-support accounts.

FROM logs-endpoint.events.process-*
| WHERE @timestamp > NOW() - 30 days AND event.action IN ("start", "exec")
| WHERE TO_LOWER(process.name) IN ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "launchctl", "killall", "pkill", "kill", "mdatp", "falconctl")
| EVAL cmd = TO_LOWER(process.command_line)
| WHERE cmd RLIKE ".*(zsatunnel|zsaservice|zscaler|zsatray|stagentsvc|stagentui|nsservice|netskope|sentinelagent|cselement|csfalconservice|cbdefense|mssense|fresno|wdavdaemon|falcond|falconctl|mdatp).*"
| WHERE cmd RLIKE ".*(stop|disable|kill|unload|bootout|delete|remove).*"
| WHERE NOT user.name IN ("svc-it-support")
| KEEP @timestamp, host.name, user.name, process.name, process.command_line, process.parent.name
| SORT @timestamp DESC
| LIMIT 200

Each row is a service-control, kill or agent command that names a SASE or endpoint agent, outside the IT-support accounts.

// Replace the placeholder with IT-support accounts, and add your own agent's service and process names to the second regular expression.
#event_simpleName=ProcessRollup2
| in(field=FileName, values=["sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "launchctl", "killall", "pkill", "kill", "mdatp", "falconctl"], ignoreCase=true)
| CommandLine=/(zsatunnel|zsaservice|zscaler|zsatray|stagentsvc|stagentui|nsservice|netskope|sentinelagent|cselement|csfalconservice|cbdefense|mssense|fresno|wdavdaemon|falcond|falconctl|mdatp)/i
// optional: delete and remove also match ordinary uninstall and clean-up commands
| CommandLine=/(stop|disable|kill|unload|bootout|delete|remove)/i
| !in(field=UserName, values=["svc-it-support"])
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Each row is a service-control, kill or agent command that names a SASE or endpoint agent, outside the IT-support accounts.

// Replace the placeholder with IT-support accounts, and add your own agent's service and process names to the second regular expression.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and lowercase(action_process_image_name) in ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "launchctl", "killall", "pkill", "kill", "mdatp", "falconctl")
| filter action_process_image_command_line ~= "(?i)(zsatunnel|zsaservice|zscaler|zsatray|stagentsvc|stagentui|nsservice|netskope|sentinelagent|cselement|csfalconservice|cbdefense|mssense|fresno|wdavdaemon|falcond|falconctl|mdatp)"
// optional: delete and remove also match ordinary uninstall and clean-up commands
| filter action_process_image_command_line ~= "(?i)(stop|disable|kill|unload|bootout|delete|remove)"
| filter actor_effective_username not in ("svc-it-support")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name
| sort desc _time