From 6668e71b6f0c57f1762a99461d8ab570779c2a01 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 7 Sep 2021 21:44:44 -0400 Subject: [PATCH 1/3] updating base on suggestions from mschilt in issue 1528 --- .../registry_keys_used_for_persistence.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 5b4c33c081..d4981a39e1 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 5 -date: '2020-11-27' -author: David Dorsey, Splunk +version: 6 +date: '2021-09-07' +author: Jose Hernandez, David Dorsey, Splunk type: TTP datamodel: - Endpoint @@ -11,11 +11,18 @@ description: The search looks for modifications to registry keys that can be use search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* - OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* - OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows - NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) + OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" Registry.registry_key_name="Security Packages") + OR Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*" + OR (Registry.registry_path="*currentVersion\\Windows" Registry.registry_key_name="Load") + OR (Registry.registry_path="*\\CurrentVersion" Registry.registry_key_name="Svchost") + OR Registry.registry_path="*\\CurrentControlSet\Control\Session Manager" Registry.registry_key_name="BootExecute") + OR Registry.registry_path="*\\Software\\Run" Registry.registry_key_name="auto_update") by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data From 6affec77b587a9ee13400c5adc2daaa2a3bff25a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 8 Sep 2021 17:41:57 -0700 Subject: [PATCH 2/3] SPL logic was wrong --- .../registry_keys_used_for_persistence.yml | 35 ++++++++++--------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d4981a39e1..bab2e67729 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -9,22 +9,25 @@ datamodel: description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* - OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Shell* - OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* - OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* - OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) - OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_key_name=Debugger) - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" Registry.registry_key_name="Security Packages") - OR Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*" - OR (Registry.registry_path="*currentVersion\\Windows" Registry.registry_key_name="Load") - OR (Registry.registry_path="*\\CurrentVersion" Registry.registry_key_name="Svchost") - OR Registry.registry_path="*\\CurrentControlSet\Control\Session Manager" Registry.registry_key_name="BootExecute") - OR Registry.registry_path="*\\Software\\Run" Registry.registry_key_name="auto_update") - by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`' + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* + OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* + OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") + OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") + OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") + OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") + OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) + by Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response From 37a2f54c26f2f83cccfd641e549ba5701943d25d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 9 Sep 2021 01:00:47 +0000 Subject: [PATCH 3/3] Added detection testing service results inRegistry Keys Used For Persistence --- .../registry_keys_used_for_persistence.yml | 36 +++++++++---------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index bab2e67729..0725a9de98 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -9,25 +9,23 @@ datamodel: description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* - OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* - OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* - OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* - OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* - OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") - OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") - OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") - OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") - OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) - by Registry.dest Registry.user -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` -| `registry_keys_used_for_persistence_filter`' + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* + OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows + NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security + Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" + AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows + NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" + AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" + AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session + Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" + AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response