Skip to content

Instantly share code, notes, and snippets.

@keyboardcrunch

keyboardcrunch/SolarWinds Process Disabling Services Via Registry.txt

Created December 18, 2020 16:33
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save keyboardcrunch/1e0ebab1d0ef746c7cd9d11e70e213c5 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save keyboardcrunch/1e0ebab1d0ef746c7cd9d11e70e213c5 to your computer and use it in GitHub Desktop.
Download ZIP
Identifies SolarWinds binaries modifying start type of a service to be disabled.
Raw
SolarWinds Process Disabling Services Via Registry.txt
(RegistryKeyPath RegExp "\bMACHINE\\SYSTEM\\.*ControlSet.*\\Services\\.*\\Start" AND EventType = "Registry Value Modified") AND SrcProcName RegExp "(.*\.)?((SolarWinds.BusinessLayerHost.*|ConfigurationWizard.*|NetflowDatabasemaintenance.*|NetFlowService.*|SolarWinds.Administration.*|SolarWinds.Collector.Service.*|SolarwindsDiagnostics.*).exe)"
@keyboardcrunch
Copy link
Author

keyboardcrunch commented Dec 18, 2020

Basically copied from the Elastic query published this week. Missing the twitter link but have this image.
https://pbs.twimg.com/media/EpdvHvrXIAcLgdV?format=png&name=large

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment