Branch was auto-updated.

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -0,0 +1,71 @@
+name: Windows Modify Show Compress Color And Info Tip Registry
+id: b7548c2e-9a10-11ec-99e3-acde48001122
+version: 1
+date: '2022-03-02'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytic is to look for suspicious registry modification related to file compression color and information tips. 
+  This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of compressed or encrypted files in NTFS 
+  file system as well as the pop up information tips. This is a good indicator that a process tries to modified one of the registry GlobalFolderOptions 
+  related to file compression attribution in terms of color in NTFS file system.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" 
+  AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
+  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
+  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
+  proc_guid | fields _time dest user parent_process_name parent_process process_name
+  process_path process proc_guid registry_path registry_value_name registry_value_data]
+  | table _time dest user parent_process_name parent_process process_name process_path
+  process proc_guid registry_path registry_value_name registry_value_data 
+  | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+known_false_positives: unknown 
+references:
+-  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1112
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.dest Registry.user
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  # (impact * confidence)/100
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

tests/endpoint/windows_modify_show_compress_color_and_info_tip_registry.test.yml

@@ -0,0 +1,12 @@
+name: Windows Modify Show Compress Color And Info Tip Registry Unit Test
+tests:
+- name: Windows Modify Show Compress Color And Info Tip Registry
+  file: endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog