author: Bhavin Patel, Splunk
date: '2019-03-01'
description: This search queries the Endpoint Datamodel to give you details of the
  latest registry values for a specific destination computer.
how_to_implement: To successfully implement this search you need to be ingesting information
  on registry changes that include the name of the process responsible for the changes
  from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
  nodes.
id: fecf2918-670d-4f1c-872b-3d7317a41xf9
inputs:
- dest
name: Get Registry Activities
search: '| tstats `security_content_summariesonly` values(Registry.registry_path)
  as registry_path values(Registry.registry_key_name) as registry_key_name count FROM
  datamodel=Endpoint.Registry where Registry.dest = "$dest$" by Registry.process_id
  Registry.dest | `drop_dm_object_name("Registry")` | join [| tstats `security_content_summariesonly`
  count values(Processes.user) as user values(Processes.process_name) as process_name
  values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes
  where Processes.process_name = reg.exe by Processes.process_id | `drop_dm_object_name("Processes")`]'
tags:
  analytic_story:
  - DHS Report TA18-074A
  - 'Emotet Malware  DHS Report TA18-201A '
  - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
  - Ransomware
  - Suspicious Command-Line Executions
  - Suspicious MSHTA Activity
  - Suspicious Windows Registry Activities
  - Windows Defense Evasion Tactics
  - Windows File Extension and Association Abuse
  - Windows Persistence Techniques
  - Windows Privilege Escalation
  product:
  - Splunk Phantom
type: response
version: 2
