admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_modify_registry_auto_minor_updates.yml

Browse Source
This commit is contained in:
tccontre
2023-05-02 18:08:12 +02:00
committed by GitHub
parent db3aa762cb
commit 16d9cedd61
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+4 -2
View File
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
status: production
type: Hunting
data_source:
- Sysmon EventID 12, 13, 14
- Sysmon EventID 12
- Sysmon EventID 13
- Sysmon EventID 14
description: The following analytic identifies a suspicious registry modification of Windows auto update configuration.
This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or
to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog