diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 46d579f45e..e3ab45ab81 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,18 +1,14 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 2 +version: 3 date: '2022-11-14' author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable - windows features. These techniques are seen in several ransomware malware to impair - the compromised host to make it hard for analyst to mitigate or response from the - attack. Disabling these known features make the analysis and forensic response more - hard. Disabling these feature is not so common but can still be implemented by the - administrator for security purposes. In this scenario filters for users that are - allowed doing this is needed. +description: The following analytic detects a suspicious registry modification used to disable + windows features. This technique has been identified in several ransomware malware families to impair + the compromised host and make it harder for analysts to mitigate or respond to an attack. search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` | join process_guid [ @@ -27,7 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: unknown +known_false_positives: Disabling these features for legitimate purposes is not a common use case but can still be implemented by the + administrators. Filter as needed. references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis @@ -37,6 +34,7 @@ tags: - Ransomware - Windows Defense Evasion Tactics - Windows Registry Abuse + - Sneaky Active Directory Persistence Tricks dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: