admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-02-06 15:43:17 -08:00
committed by GitHub
parent 2443d003d7 34ec428399
commit 0805cbabd0
54 changed files with 1539 additions and 1287 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+2 -3
View File
@@ -463,9 +463,8 @@ jobs:
- name: Generate content version and timestamp JSON
run : |
curl -o version-api.json https://api.github.com/repositories/162346001/releases/latest
VERSION_VAL=$(cat version-api.json | jq '.name')
VERSION_TS=$(cat version-api.json | jq '.published_at')
VERSION_VAL=$GITHUB_REF_NAME
VERSION_TS=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
echo "{\"version\":{\"name\":$VERSION_VAL,\"published_at\":$VERSION_TS}}" > dist/api/version.json
echo "contents of version.json:"
cat dist/api/version.json
detections/endpoint/active_setup_registry_autostart.yml
+29 -25
View File
@@ -1,8 +1,8 @@
name: Active Setup Registry Autostart
id: f64579c0-203f-11ec-abcc-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -13,25 +13,19 @@ description: This analytic is to detect a suspicious modification of the active
do the modification since modification of this registry is not commonly done. check
the legitimacy of the file and process involve in this rules to check if it is a
valid setup installer that creating or modifying this registry.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active
Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
parent_process process_name process_path process proc_guid registry_path registry_value_name
registry_value_data | `active_setup_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Active setup installer may add or modify this registry.
references:
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FPoisonivy.E
@@ -69,11 +63,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 64
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+31 -25
View File
@@ -1,8 +1,8 @@
name: Add DefaultUser And Password In Registry
id: d4a3eb62-0f1e-11ec-a971-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -12,25 +12,20 @@ description: this search is to detect a suspicious registry modification to impl
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name=
DefaultUserName by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.process_guid Registry.registry_value_data
Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `add_defaultuser_and_password_in_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `add_defaultuser_and_password_in_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
@@ -62,10 +57,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
supported_tas:
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+29 -26
View File
@@ -1,8 +1,8 @@
name: Allow Inbound Traffic By Firewall Rule Registry
id: 0a46537c-be02-11eb-92ca-acde48001122
version: 3
date: '2022-07-19'
author: Teoderick Contreras, Splunk
version: 4
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,25 +10,20 @@ description: This analytic detects a potential suspicious modification of firewa
rule registry allowing inbound traffic in specific port with public profile. This
technique was identified when an adversary wants to grant remote access to a machine
by allowing the traffic in a firewall rule.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
"*|Dir=In|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest
Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid
Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `allow_inbound_traffic_by_firewall_rule_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network admin may add/remove/modify public inbound firewall
rule that may cause this rule to be triggered.
references:
@@ -68,13 +63,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.action
- Registry.dest
- Registry.user
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/allow_operation_with_consent_admin.yml
+30 -26
View File
@@ -1,8 +1,8 @@
name: Allow Operation with Consent Admin
id: 7de17d7a-c9d8-11eb-a812-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,27 +11,20 @@ description: This analytic identifies a potential privilege escalation attempt t
Admin` to perform an operation that requires elevation without consent or credentials.
We also found this in some attacker to gain privilege escalation to the compromise
machine.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
= "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `allow_operation_with_consent_admin_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
@@ -69,10 +62,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
supported_tas:
detections/endpoint/auto_admin_logon_registry_entry.yml
+30 -24
View File
@@ -1,8 +1,8 @@
name: Auto Admin Logon Registry Entry
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,25 +12,20 @@ description: this search is to detect a suspicious registry modification to impl
continue encrypting the whole network. This behavior is not a common practice and
really a suspicious TTP or alert need to be consider if found within then network
premise.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND
Registry.registry_value_data=1 by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `auto_admin_logon_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
@@ -63,10 +58,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 63
security_domain: endpoint
supported_tas:
detections/endpoint/disable_amsi_through_registry.yml
+31 -24
View File
@@ -1,32 +1,29 @@
name: Disable AMSI Through Registry
id: 9c27ec42-d338-11eb-9044-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: this search is to identify modification in registry to disable AMSI windows
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time
span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_amsi_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_amsi_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network operator may disable this feature of windows but not
so common.
references:
@@ -58,11 +55,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
asset_type: Endpoint
confidence: 50
detections/endpoint/disable_defender_antivirus_registry.yml
+23 -14
View File
@@ -1,8 +1,8 @@
name: Disable Defender AntiVirus Registry
id: aa4f695a-3024-11ec-9987-acde48001122
version: 3
date: '2022-12-21'
author: Teoderick Contreras, Splunk, Steven Dick
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,19 +12,19 @@ description: This particular behavior is typically executed when an adversary or
task modifications will occur. During triage, review parallel processes and identify
any further file modifications. Endpoint should be isolated.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_antivirus_registry_filter`'
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_antivirus_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -60,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+25 -19
View File
@@ -1,8 +1,8 @@
name: Disable Defender BlockAtFirstSeen Feature
id: 2dd719ac-3021-11ec-97b4-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,23 +10,20 @@ description: This analytic is intended to detect a suspicious modification of th
a Windows Defender feature. This technique is intended to bypass or evade detection from
Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks
suspicious files the first time seen on the host.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h
Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_blockatfirstseen_feature_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_blockatfirstseen_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -63,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_defender_enhanced_notification.yml
+26 -20
View File
@@ -1,8 +1,8 @@
name: Disable Defender Enhanced Notification
id: dc65678c-301f-11ec-8e30-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,23 +10,20 @@ description: This analytic is intended to detect a suspicious modification of re
windows defender features. This technique attempts to bypass or evade detection from
Windows Defender AV, specifically the Enhanced Notification feature where a user
or admin would receive alerts.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name
= DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time
span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_enhanced_notification_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_antivirus_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data executions
from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
of the Sysmon TA.
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: user may choose to disable windows defender AV
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -63,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_defender_mpengine_registry.yml
+25 -19
View File
@@ -1,8 +1,8 @@
name: Disable Defender MpEngine Registry
id: cc391750-3024-11ec-955a-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,23 +11,20 @@ description: This particular behavior is typically executed when an adversary or
detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled
task modifications will occur. During triage, review parallel processes and identify
any further file modifications. Endpoint should be isolated.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*"
Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_mpengine_registry_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_mpengine_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -63,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_defender_spynet_reporting.yml
+25 -19
View File
@@ -1,31 +1,28 @@
name: Disable Defender Spynet Reporting
id: 898debf4-3021-11ec-ba7c-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is intended to detect a suspicious modification of registry to disable
Windows Defender feature. This technique is intended to bypass or evade detection from
Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest
Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_spynet_reporting_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_spynet_reporting_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -63,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+25 -19
View File
@@ -1,31 +1,28 @@
name: Disable Defender Submit Samples Consent Feature
id: 73922ff8-3022-11ec-bf5e-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
a Windows Defender feature. This technique is intended to bypass or evade detection from
Windows Defender AV, specifically the feature that submits samples for further analysis.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h
Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_submit_samples_consent_feature_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_submit_samples_consent_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -62,12 +59,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_etw_through_registry.yml
+30 -23
View File
@@ -1,8 +1,8 @@
name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,23 +10,20 @@ description: this search is to identify modification in registry to disable ETW
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: network operator may disable this feature of windows but not
so common.
references:
@@ -57,11 +54,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
asset_type: Endpoint
confidence: 50
detections/endpoint/disable_registry_tool.yml
+30 -23
View File
@@ -1,8 +1,8 @@
name: Disable Registry Tool
id: cd2cf33c-9201-11eb-a10a-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,23 +11,20 @@ description: This search identifies modification of registry to disable the rege
knife in analyzing registry, malware such as RAT or trojan Spy disable this application
to prevent the removal of their registry entry such as persistence, file less components
and defense evasion.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_registry_tool_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_registry_tool_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -61,11 +58,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 40
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_security_logs_using_minint_registry.yml
+27 -22
View File
@@ -1,8 +1,8 @@
name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,24 +10,20 @@ description: This analytic is to detect a suspicious registry modification to di
security audit logs. This technique was shared by a researcher to disable Security
logs of windows by adding this registry. The Windows will think it is WinPE and
will not log any event to the Security Log
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest
Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Unknown.
references:
- https://twitter.com/0gtweet/status/1182516740955226112
@@ -62,12 +58,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_show_hidden_files.yml
+30 -25
View File
@@ -1,8 +1,8 @@
name: Disable Show Hidden Files
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Mauricio Velazco, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,25 +10,20 @@ description: The following analytic is to identify a modification in the Windows
to prevent users from seeing all the files with hidden attributes. This event or
techniques are known on some worm and trojan spy malware that will drop hidden files
on the infected machine.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
Registry.registry_value_data = "0x00000000") by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis
@@ -65,11 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Registry.dest
- Registry.registry_value_nam
- Registry.registry_value_data
- Registry.process_guid
risk_score: 40
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_uac_remote_restriction.yml
+29 -25
View File
@@ -1,8 +1,8 @@
name: Disable UAC Remote Restriction
id: 9928b732-210e-11ec-b65e-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,25 +11,20 @@ description: This analytic is to detect a suspicious modification of registry to
attacker may modify this registry value to bypassed UAC feature of windows host.
This is a good indicator that some tries to bypassed UAC to suspicious process or
gain privilege escalation.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*"
Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_uac_remote_restriction_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" ) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_uac_remote_restriction_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may set this policy for non-critical machine.
references:
- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
@@ -66,12 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_windows_app_hotkeys.yml
+29 -25
View File
@@ -1,8 +1,8 @@
name: Disable Windows App Hotkeys
id: 1490f224-ad8b-11eb-8c4f-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunkk
type: TTP
datamodel:
- Endpoint
@@ -11,27 +11,20 @@ description: This analytic detects a suspicious registry modification to disable
used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
This technique is used to impair the analyst in analyzing and removing the attacker
implant in compromised systems.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution
Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name
= "Debugger" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_windows_app_hotkeys_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -63,10 +56,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Registry.registry_value_data
- Registry.process_guidr
risk_score: 40
security_domain: endpoint
supported_tas:
detections/endpoint/disable_windows_behavior_monitoring.yml
+30 -30
View File
@@ -1,38 +1,28 @@
name: Disable Windows Behavior Monitoring
id: 79439cae-9200-11eb-a4d3-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to identifies a modification in registry to disable the
windows denfender real time behavior monitoring. This event or technique is commonly
seen in RAT, bot, or Trojan to disable AV to evade detections.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path=
"*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time
Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time
Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning"
AND Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_behavior_monitoring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_windows_behavior_monitoring_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
@@ -69,11 +59,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 40
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disable_windows_smartscreen_protection.yml
+30 -22
View File
@@ -1,8 +1,8 @@
name: Disable Windows SmartScreen Protection
id: 664f0fd0-91ff-11eb-a56f-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,22 +11,20 @@ description: The following search identifies a modification of registry to disab
early warning system against website that might engage in phishing attack or malware
distribution. This modification are seen in RAT malware to cover their tracks upon
downloading other of its component or other payload.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data=
"Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_smartscreen_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= "Off") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_windows_smartscreen_protection_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
@@ -64,11 +62,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Registry.dest
- Registry.registry_value_nam
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_cmd_application.yml
+30 -24
View File
@@ -1,8 +1,8 @@
name: Disabling CMD Application
id: ff86077c-9212-11eb-a1e6-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,24 +10,20 @@ description: this search is to identify modification in registry to disable cmd
application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
or deleting there samples through cmd application which is one of the tool of analyst
to traverse on directory and files.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -65,11 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_controlpanel.yml
+31 -24
View File
@@ -1,32 +1,29 @@
name: Disabling ControlPanel
id: 6ae0148e-9215-11eb-a94a-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: this search is to identify registry modification to disable control panel
window. This technique is commonly seen in malware to prevent their artifacts ,
persistence removed on the infected machine.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -64,11 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_defender_services.yml
+26 -21
View File
@@ -1,8 +1,8 @@
name: Disabling Defender Services
id: 911eacdc-317f-11ec-ad30-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,24 +11,20 @@ description: This particular behavior is typically executed when an adversaries
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
task modifications will occur. During triage, review parallel processes and identify
any further file modifications. Endpoint should be isolated.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path
IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*"))
AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `disabling_defender_services_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_defender_services_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
@@ -64,12 +60,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_folderoptions_windows_feature.yml
+30 -24
View File
@@ -1,8 +1,8 @@
name: Disabling FolderOptions Windows Feature
id: 83776de4-921a-11eb-868a-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,24 +11,20 @@ description: This search is to identify registry modification to disable folder
used by malware in combination if disabling show hidden files feature to hide their
files and also to hide the file extension to lure the user base on file icons or
fake file extensions.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_folderoptions_windows_feature_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_folderoptions_windows_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -66,11 +62,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_norun_windows_app.yml
+30 -24
View File
@@ -1,8 +1,8 @@
name: Disabling NoRun Windows App
id: de81bc46-9213-11eb-adc9-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,24 +11,20 @@ description: This search is to identify modification of registry to disable run
OS user to run known application and also to execute some reg or batch script. This
technique is used malware to make cleaning of its infection more harder by preventing
known application run easily through run shortcut.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_norun_windows_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_norun_windows_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -68,11 +64,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_systemrestore_in_registry.yml
+30 -27
View File
@@ -1,8 +1,8 @@
name: Disabling SystemRestore In Registry
id: f4f837e2-91fb-11eb-8bf6-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,27 +10,20 @@ description: The following search identifies the modification of registry relate
in disabling the system restore of a machine. This event or behavior are seen in
some RAT malware to make the restore of the infected machine difficult and keep
their infection on the box.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_systemrestore_in_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_systemrestore_in_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: in some cases admin can disable systemrestore on a machine.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
@@ -68,11 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/disabling_task_manager.yml
+30 -25
View File
@@ -1,8 +1,8 @@
name: Disabling Task Manager
id: dac279bc-9202-11eb-b7fb-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,24 +10,20 @@ description: This search is to identifies modification of registry to disable th
task manager of windows operating system. this event or technique are commonly seen
in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
their process.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `disabling_task_manager_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disabling_task_manager_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may disable this application for non technical user.
references:
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
@@ -65,12 +61,21 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 42
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/enable_rdp_in_other_port_number.yml
+29 -22
View File
@@ -1,8 +1,8 @@
name: Enable RDP In Other Port Number
id: 99495452-b899-11eb-96dc-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,24 +10,20 @@ description: This search is to detect a modification to registry to enable rdp t
a machine with different port number. This technique was seen in some atttacker
tries to do lateral movement and remote access to a compromised machine to gain
control of it.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by _time
span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `enable_rdp_in_other_port_number_filter`'
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `enable_rdp_in_other_port_number_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
@@ -62,10 +58,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+26 -24
View File
@@ -1,8 +1,8 @@
name: Enable WDigest UseLogonCredential Registry
id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,27 +11,20 @@ description: This analytic is to detect a suspicious registry modification to en
and also by mimikatz to be able to dumpe the a plain text credential to the compromised
or target host. This TTP is really a good indicator that someone wants to dump the
crendential of the host so it must be a good pivot for credential dumping techniques.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data
= 0x00000001 by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `enable_wdigest_uselogoncredential_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
@@ -68,12 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/etw_registry_disabled.yml
+29 -27
View File
@@ -1,35 +1,28 @@
name: ETW Registry Disabled
id: 8ed523ac-276b-11ec-ac39-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to detect a registry modification to disable ETW feature
of windows. This technique is to evade EDR appliance to evade detections and hide
its execution from audit logs.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*"
Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
its execution from audit logs.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `etw_registry_disabled_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
@@ -68,12 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 90
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/eventvwr_uac_bypass.yml
+29 -23
View File
@@ -1,8 +1,8 @@
name: Eventvwr UAC Bypass
id: 9cf8fe08-7ad8-11eb-9819-acde48001122
version: 2
date: '2022-01-28'
author: Michael Haag, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,24 +12,20 @@ description: The following search identifies Eventvwr bypass by identifying the
upon eventvwr.msc loading. Upon triage, review the parallel processes that have
executed. Identify any additional registry modifications on the endpoint that may
look suspicious. Remediate as necessary.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*mscfile\\shell\\open\\command\\*"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*mscfile\\shell\\open\\command\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `eventvwr_uac_bypass_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Some false positives may be present and will need to be filtered.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
@@ -72,11 +68,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/hide_user_account_from_sign_in_screen.yml
+29 -25
View File
@@ -1,8 +1,8 @@
name: Hide User Account From Sign-In Screen
id: 834ba832-ad89-11eb-937d-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,27 +11,20 @@ description: This analytic identifies a suspicious registry modification to hide
where the adversary will create a hidden user account with Admin privileges in login
screen to avoid noticing by the user that they already compromise and to persist
on that said machine.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data
= "0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `hide_user_account_from_sign_in_screen_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Unknown. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,10 +67,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Registry.registry_value_data
- Registry.process_guid
risk_score: 72
security_domain: endpoint
supported_tas:
detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+29 -26
View File
@@ -1,8 +1,8 @@
name: Monitor Registry Keys for Print Monitors
id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
version: 3
date: '2020-01-28'
author: Bhavin Patel, Teoderick Contreras, Splunk
version: 4
date: '2022-11-14'
author: Steven Dick, Bhavin Patel, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,26 +11,20 @@ description: This search looks for registry activity associated with modificatio
scenario, an attacker can load an arbitrary .dll into the print-monitor registry
by giving the full path name to the after.dll. The system will execute the .dll
with elevated (SYSTEM) permissions and will persist after reboot.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `monitor_registry_keys_for_print_monitors_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
The data used for this search is typically generated via logs that report registry
modifications.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: You will encounter noise from legitimate print-monitor registry
entries.
references: []
@@ -74,11 +68,20 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.action
- Registry.registry_path
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_key_name
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 64
security_domain: endpoint
detections/endpoint/registry_keys_for_creating_shim_databases.yml
+30 -22
View File
@@ -1,30 +1,27 @@
name: Registry Keys for Creating SHIM Databases
id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
version: 4
date: '2020-01-28'
author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
version: 5
date: '2022-11-14'
author: Steven Dick, Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search looks for registry activity associated with application compatibility
shims, which can be leveraged by attackers for various nefarious purposes.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `registry_keys_for_creating_shim_databases_filter`'
how_to_implement: To successfully implement this search, you must populate the Change_Analysis
data model. This is typically populated via endpoint detection and response product,
such as Carbon Black or other endpoint data sources such as Sysmon. The data used
for this search is typically generated via logs that report reads and writes to
the registry.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `registry_keys_for_creating_shim_databases_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: There are many legitimate applications that leverage shim databases
for compatibility purposes for legacy applications
references: []
@@ -68,9 +65,20 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.dest
- Registry.user
- Registry.registry_value_data
- Registry.process_guid
risk_score: 56
security_domain: endpoint
detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+30 -26
View File
@@ -1,8 +1,8 @@
name: Registry Keys Used For Privilege Escalation
id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
version: 5
date: '2022-01-26'
author: David Dorsey, Teoderick Contreras, Splunk
version: 6
date: '2022-11-14'
author: Steven Dick, David Dorsey, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,27 +10,20 @@ description: This search looks for modifications to registry keys that can be us
to elevate privileges. The registry keys under "Image File Execution Options" are
used to intercept calls to an executable and can be used to attach malicious binaries
to benign system binaries.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File
Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid Registry.registry_key_name |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `registry_keys_used_for_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: There are many legitimate applications that must execute upon
system startup and will use these registry keys to accomplish that task.
references:
@@ -76,10 +69,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 76
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/remcos_client_registry_install_entry.yml
+31 -23
View File
@@ -1,29 +1,27 @@
name: Remcos client registry install entry
id: f2a1615a-1d63-11ec-97d2-acde48001122
version: 2
date: '2022-01-26'
author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This search detects registry key license at host where Remcos RAT agent
is installed.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest
Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data |`remcos_client_registry_install_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_key_name=*\\Software\\Remcos*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
|`remcos_client_registry_install_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/570
known_false_positives: unknown
references:
- https://attack.mitre.org/software/S0332/
@@ -55,11 +53,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.process_id
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 90
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/revil_registry_entry.yml
+29 -21
View File
@@ -1,8 +1,8 @@
name: Revil Registry Entry
id: e3d3f57a-c381-11eb-9e35-acde48001122
version: 2
date: '2021-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,22 +11,20 @@ description: This analytic identifies suspicious modification in registry entry
implant, malware and ransomware like REVIL where it keep some information like the
random generated file extension it uses for all the encrypted files and ransomware
notes file name in the compromised host.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time
span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `revil_registry_entry_filter`'
how_to_implement: to successfully implement this search, you need to be ingesting
logs with the Image, TargetObject registry key, registry Details from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `revil_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
@@ -64,11 +62,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_value_name
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 60
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/sdclt_uac_bypass.yml
+30 -24
View File
@@ -1,8 +1,8 @@
name: Sdclt UAC Bypass
id: d71efbf6-da63-11eb-8c6e-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,25 +10,20 @@ description: This search is to detect a suspicious sdclt.exe registry modificati
This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe
application by modifying some registry that sdclt.exe tries to open or query with
payload file path on it to be executed.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App
Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*")
(Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `sdclt_uac_bypass_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Limited to no false positives are expected.
references:
- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
@@ -66,10 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 63
security_domain: endpoint
supported_tas:
detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+31 -16
View File
@@ -1,23 +1,27 @@
name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
id: c2590137-0b08-4985-9ec5-6ae23d92f63d
version: 7
date: '2022-02-18'
author: Patrick Bareiss, Splunk
version: 8
date: '2022-11-14'
author: Steven Dick, Patrick Bareiss, Splunk
type: TTP
datamodel:
- Endpoint
description: Monitor for changes of the ExecutionPolicy in the registry to the values
"unrestricted" or "bypass," which allows the execution of malicious scripts.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted
OR Registry.registry_value_data=Bypass) by Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Registry node. You must also be
ingesting logs with the fields registry_path, registry_key_name, and registry_value_name
from your endpoints.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Administrators may attempt to change the default execution
policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
or "bypass" as this search is designed to identify, would be unusual. Hits should
@@ -65,10 +69,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 48
security_domain: endpoint
supported_tas:
detections/endpoint/silentcleanup_uac_bypass.yml
+30 -23
View File
@@ -1,8 +1,8 @@
name: SilentCleanup UAC Bypass
id: 56d7cfcc-da63-11eb-92d4-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,24 +10,20 @@ description: This search is to detect a suspicious modification of registry that
related to UAC bypassed. This registry will be trigger once the attacker abuse the
silentcleanup task schedule to gain high privilege execution that will bypass User
control account.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data
= "*.exe*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid Registry.registry_key_name |
`drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name] | table
_time dest user parent_process_name parent_process process_name process_path process
proc_guid registry_path registry_value_name registry_value_data registry_key_name
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `silentcleanup_uac_bypass_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://github.com/hfiref0x/UACME
@@ -63,10 +59,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 63
security_domain: endpoint
supported_tas:
detections/endpoint/time_provider_persistence_registry.yml
+30 -25
View File
@@ -1,8 +1,8 @@
name: Time Provider Persistence Registry
id: 5ba382c4-2105-11ec-8d8f-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -11,25 +11,20 @@ description: This analytic is to detect a suspicious modification of time provid
persist on the compromised host and autostart as soon as the machine boot up. This
TTP can be a good indicator of suspicious behavior since this registry is not commonly
modified by normal user or even an admin.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest
Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `time_provider_persistence_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://pentestlab.blog/2019/10/22/persistence-time-providers/
@@ -68,11 +63,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_defender_exclusion_registry_entry.yml
+29 -24
View File
@@ -1,8 +1,8 @@
name: Windows Defender Exclusion Registry Entry
id: 13395a44-4dd9-11ec-9df7-acde48001122
version: 1
date: '2021-11-25'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,23 +12,20 @@ description: This analytic will detect a suspicious process that modify a regist
excluding folder path, file path, process, extensions and etc. from its real time
or schedule scan to execute their malicious code. This is a good indicator for a
defense evasion and to look further for events after this behavior.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Exclusions\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
parent_process process_name process_path process proc_guid registry_path registry_value_name
registry_value_data | `windows_defender_exclusion_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_defender_exclusion_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to use this windows features.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
@@ -67,13 +64,21 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 64
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml
+23 -31
View File
@@ -1,8 +1,8 @@
name: Windows Deleted Registry By A Non Critical Process File Path
id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2
version: 1
date: '2022-03-28'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -10,24 +10,16 @@ description: This analytic is to detect deletion of registry with suspicious pro
where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections
can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application
updates or installation. In this scenario false positive filter is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.action=deleted by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action] | table _time parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action dest user
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry WHERE Registry.action=deleted BY _time span=1h Registry.dest Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data Registry.action
| `drop_dm_object_name(Registry)`
| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.user Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid
| `drop_dm_object_name(Processes)`]
| fields _time parent_process_name parent_process process_name process_path process process_guid registry_path registry_value_name registry_value_data registry_key_name action dest user
| `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This detection can catch for third party application
updates or installation. In this scenario false positive filter is needed.
references:
@@ -63,20 +55,20 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest
- Registry.user
- Registry.action
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Processes.process_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 36
security_domain: endpoint
detections/endpoint/windows_disable_change_password_through_registry.yml
+30 -30
View File
@@ -1,8 +1,8 @@
name: Windows Disable Change Password Through Registry
id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -11,23 +11,20 @@ description: This analytic is to detect a suspicious registry modification to di
As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password
after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of
a critical host or server, In this type of scenario filter is needed to minimized false positive.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
Registry.registry_value_data = "0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_change_password_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of
a critical host or server, In this type of scenario filter is needed to minimized false positive.
references:
@@ -48,18 +45,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest
- Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
@@ -80,4 +80,4 @@ tags:
- CIS 3
- CIS 5
- CIS 16
asset_type: Endpoint
asset_type: Endpoint
detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+30 -28
View File
@@ -1,8 +1,8 @@
name: Windows Disable Lock Workstation Feature Through Registry
id: c82adbc6-9f00-11ec-a81f-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -11,22 +11,20 @@ description: This analytic is to detect a suspicious registry modification to di
locking its screen or computer that are being abused by several malware for example
ransomware. This technique was used by threat actor to make its payload more impactful
to the compromised host.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_lock_workstation_feature_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_lock_workstation_feature_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/
@@ -48,17 +46,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
detections/endpoint/windows_disable_logoff_button_through_registry.yml
+30 -29
View File
@@ -1,8 +1,8 @@
name: Windows Disable LogOff Button Through Registry
id: b2fb6830-9ed1-11ec-9fcb-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -15,23 +15,20 @@ description: This analytic is to detect a suspicious registry modification to di
made on the machine that needs restart to take effect. This windows feature may
implement by administrator in some server where shutdown is critical. In that scenario
filter of machine and users that can modify this registry is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
= "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid,
_time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
parent_process process_name process_path process proc_guid registry_path registry_value_name
registry_value_data | `windows_disable_logoff_button_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_logoff_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implement by administrator in some
server where shutdown is critical. In that scenario filter of machine and users
that can modify this registry is needed.
@@ -55,17 +52,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
detections/endpoint/windows_disable_notification_center.yml
+31 -26
View File
@@ -1,8 +1,8 @@
name: Windows Disable Notification Center
id: 1cd983c8-8fd6-11ec-a09d-acde48001122
version: 1
date: '2022-02-17'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -11,24 +11,20 @@ description: The following search identifies a modification of registry to disab
notification and action center from the notification area on the task bar.
This modification are seen in RAT malware to cover their tracks upon
downloading other of its component or other payload.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_value_name= "DisableNotificationCenter"
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid
Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `windows_disable_notification_center_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_notification_center_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable this windows features.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
@@ -47,12 +43,21 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Registry.dest
- Registry.registry_value_nam
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 60
confidence: 80
@@ -76,4 +81,4 @@ tags:
- DE.CM
cis20:
- CIS 8
asset_type: Endpoint
asset_type: Endpoint
detections/endpoint/windows_disable_shutdown_button_through_registry.yml
+30 -29
View File
@@ -1,8 +1,8 @@
name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -13,23 +13,20 @@ description: This analytic is to detect a suspicious registry modification to di
needs restart to take effect. This windows feature may implement by administrator
in some server where shutdown is critical. In that scenario filter of machine and
users that can modify this registry is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_shutdown_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: This windows feature may implement by administrator in some
server where shutdown is critical. In that scenario filter of machine and users
that can modify this registry is needed.
@@ -51,17 +48,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
+30 -31
View File
@@ -1,8 +1,8 @@
name: Windows Disable Windows Group Policy Features Through Registry
id: 63a449ae-9f04-11ec-945e-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -13,25 +13,20 @@ description: This analytic is to detect a suspicious registry modification to di
hard. Disabling these feature is not so common but can still be implemented by the
administrator for security purposes. In this scenario filters for users that are
allowed doing this is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*"
Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu",
"NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments")
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_windows_group_policy_features_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_windows_group_policy_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en
@@ -54,17 +49,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
detections/endpoint/windows_hide_notification_features_through_registry.yml
+30 -29
View File
@@ -1,8 +1,8 @@
name: Windows Hide Notification Features Through Registry
id: cafa4bce-9f06-11ec-a7b2-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
@@ -12,23 +12,20 @@ description: This analytic is to detect a suspicious registry modification to hi
by user aside from the encrypted files and ransomware notes. Even this a good anomaly
detection, administrator may implement this changes for auditing or security reason.
In this scenario filter is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
"HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by
_time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_hide_notification_features_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_hide_notification_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/
@@ -49,17 +46,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_value_data
- Registry.process_guid
security_domain: endpoint
impact: 70
confidence: 70
detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+30 -21
View File
@@ -1,8 +1,8 @@
name: Windows Modify Show Compress Color And Info Tip Registry
id: b7548c2e-9a10-11ec-99e3-acde48001122
version: 1
date: '2022-03-02'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -13,22 +13,20 @@ description: This analytic is to look for suspicious registry modification relat
tips. This is a good indicator that a process tries to modified one of the registry
GlobalFolderOptions related to file compression attribution in terms of color in
NTFS file system.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip") by _time span=1h
Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_modify_show_compress_color_and_info_tip_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
@@ -67,10 +65,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_name
- Registry.dest Registry.user
- Registry.registry_value_data
- Registry.process_guid
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_service_creation_using_registry_entry.yml
+30 -30
View File
@@ -1,8 +1,8 @@
name: Windows Service Creation Using Registry Entry
id: 25212358-948e-11ec-ad47-acde48001122
version: 1
date: '2022-02-23'
author: Teoderick Contreras, Splunk
version: 2
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -12,23 +12,20 @@ description: This analytic is to look for suspicious modification or creation of
can be executed using reg.exe application or using windows API like for example
the CrashOveride malware. This detection is a good indicator that a process is trying
to create a service entry using registry ImagePath.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*"
Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path
process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_service_creation_using_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: Third party tools may used this technique to create services
but not so common.
references:
@@ -71,18 +68,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_key_name
- Registry.registry_path
- Registry.user
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 64
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/wsreset_uac_bypass.yml
+31 -25
View File
@@ -1,8 +1,8 @@
name: WSReset UAC Bypass
id: 8b5901bc-da63-11eb-be43-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
version: 3
date: '2022-11-14'
author: Steven Dick, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
@@ -10,25 +10,20 @@ description: This search is to detect a suspicious modification of registry rela
to UAC bypass. This technique is to modify the registry in this detection, create
a registry value with the path of the payload and run WSreset.exe to bypass User
account Control.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*"
AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name
= "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
Registry.registry_key_name | `drop_dm_object_name(Registry)` |rename process_guid
as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
proc_guid | fields _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name] | table _time dest user parent_process_name parent_process process_name
process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name | `wsreset_uac_bypass_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
that this registry was included in your config files ex. sysmon config to be monitored.
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid
[| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `wsreset_uac_bypass_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: unknown
references:
- https://github.com/hfiref0x/UACME
@@ -66,10 +61,21 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 63
security_domain: endpoint
supported_tas: