Merge pull request #1645 from splunk/Hives

Renaming Detection - Extract SAM from Registry

detections/endpoint/extraction_of_registry_hives.yml

@@ -1,4 +1,4 @@
-name: Extract SAM from Registry
+name: Extraction of Registry Hives
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
 version: 1
 date: '2021-05-12'
@@ -12,11 +12,11 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
-  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam
+  * OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.

tests/endpoint/extraction_of_registry_hives.test.yml

@@ -1,7 +1,7 @@
-name: Extract SAM from Registry Unit Test
+name: Extraction of Registry Hives Unit Test
 tests:
-- name: Extract SAM from Registry
-  file: endpoint/extract_sam_from_registry.yml
+- name: Extraction of Registry Hives
+  file: endpoint/extraction_of_registry_hives.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'