From 375a824d40baaa2ff960a2114556f6511d7075aa Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 6 May 2021 12:58:40 -0400 Subject: [PATCH] minor update to include DM closes issue #1357 --- detections/endpoint/registry_keys_used_for_persistence.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 9bef6ba923..b585325c63 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -4,7 +4,8 @@ version: 5 date: '2020-11-27' author: David Dorsey, Splunk type: batch -datamodel: [] +datamodel: + - Endpoint description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)