From d7fccdb35325fd08e5e4676704614c8e82f4aaca Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 11:39:39 +0100 Subject: [PATCH 1/4] add_story_and_minor_fix --- .../modify_acl_permission_to_files_or_folder.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 112716412e..b9cc64fa9e 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -1,9 +1,9 @@ name: Modify ACL permission To Files Or Folder id: 7e8458cc-acca-11eb-9e3f-acde48001122 -version: 1 -date: '2021-05-04' +version: 2 +date: '2022-03-17' author: Teoderick Contreras, Splunk -type: TTP +type: Anomaly datamodel: - Endpoint description: This analytic identifies suspicious modification of ACL permission to @@ -14,9 +14,9 @@ description: This analytic identifies suspicious modification of ACL permission no permission to do so. search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" - OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe" - AND (Processes.process = "*/G everyone:*" OR Processes.process = "*/G SYSTEM:*") + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" + OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") + AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' From 07b501035ede47480697d552b847f0941d516ca0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 13:54:37 +0100 Subject: [PATCH 2/4] detections/endpoint/disabling_systemrestore_in_registry.yml --- detections/endpoint/disabling_systemrestore_in_registry.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 7c0d4a8bef..6b53a267c5 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -51,8 +51,7 @@ tags: message: The Windows registry was modified to disable system restore on $dest$ by $user$. mitre_attack_id: - - T1562.001 - - T1562 + - T1490 observable: - name: user type: User From 81607c596e11af71f5d15e1f929689f63072669a Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 17 Mar 2022 16:41:29 +0100 Subject: [PATCH 3/4] add_story_and_minor_fix --- ...ound_traffic_by_firewall_rule_registry.yml | 1 + .../allow_operation_with_consent_admin.yml | 1 + ...dential_dump_from_registry_via_reg_exe.yml | 1 + .../auto_admin_logon_registry_entry.yml | 1 + .../change_default_file_association.yml | 1 + .../disable_amsi_through_registry.yml | 1 + .../disable_defender_antivirus_registry.yml | 1 + ...able_defender_blockatfirstseen_feature.yml | 1 + ...disable_defender_enhanced_notification.yml | 1 + .../disable_defender_mpengine_registry.yml | 1 + .../disable_defender_spynet_reporting.yml | 1 + ...efender_submit_samples_consent_feature.yml | 1 + .../endpoint/disable_etw_through_registry.yml | 1 + detections/endpoint/disable_registry_tool.yml | 1 + ...le_security_logs_using_minint_registry.yml | 1 + .../endpoint/disable_show_hidden_files.yml | 1 + .../disable_uac_remote_restriction.yml | 1 + .../endpoint/disable_windows_app_hotkeys.yml | 1 + .../disable_windows_behavior_monitoring.yml | 1 + ...disable_windows_smartscreen_protection.yml | 1 + .../endpoint/disabling_cmd_application.yml | 1 + .../endpoint/disabling_controlpanel.yml | 1 + .../endpoint/disabling_defender_services.yml | 1 + ...isabling_folderoptions_windows_feature.yml | 1 + .../endpoint/disabling_norun_windows_app.yml | 1 + .../disabling_remote_user_account_control.yml | 1 + .../disabling_systemrestore_in_registry.yml | 1 + .../endpoint/disabling_task_manager.yml | 1 + .../enable_rdp_in_other_port_number.yml | 1 + ...le_wdigest_uselogoncredential_registry.yml | 1 + detections/endpoint/etw_registry_disabled.yml | 1 + detections/endpoint/eventvwr_uac_bypass.yml | 1 + .../hide_user_account_from_sign_in_screen.yml | 1 + .../endpoint/modification_of_wallpaper.yml | 1 + ...nitor_registry_keys_for_print_monitors.yml | 1 + ...istry_keys_for_creating_shim_databases.yml | 1 + .../registry_keys_used_for_persistence.yml | 1 + ...try_keys_used_for_privilege_escalation.yml | 1 + .../remcos_client_registry_install_entry.yml | 1 + detections/endpoint/revil_registry_entry.yml | 1 + .../screensaver_event_trigger_execution.yml | 1 + detections/endpoint/sdclt_uac_bypass.yml | 1 + .../endpoint/silentcleanup_uac_bypass.yml | 1 + .../time_provider_persistence_registry.yml | 1 + ...k_workstation_feature_through_registry.yml | 1 + ...disable_logoff_button_through_registry.yml | 1 + .../windows_disable_memory_crash_dump.yml | 1 + .../windows_disable_notification_center.yml | 1 + ...sable_shutdown_button_through_registry.yml | 1 + ...group_policy_features_through_registry.yml | 1 + .../windows_disableantispyware_reg.yml | 1 + ...notification_features_through_registry.yml | 1 + ...w_compress_color_and_info_tip_registry.yml | 1 + ..._service_creation_using_registry_entry.yml | 1 + detections/endpoint/wsreset_uac_bypass.yml | 1 + stories/windows_registry_abuse.yml | 27 +++++++++++++++++++ 56 files changed, 82 insertions(+) create mode 100644 stories/windows_registry_abuse.yml diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 818a34cceb..d30954b5a0 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch + - Windows Registry Abuse confidence: 30 context: - Source:Endpoint diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 2d68b73c46..219f2cc83b 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - Ransomware + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index aa394e6e86..280cd8db84 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Credential Dumping - DarkSide Ransomware + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 5123a979bc..bd73fd27b6 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - BlackMatter Ransomware + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 2ff112da2b..9ccf8f7656 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -30,6 +30,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 9fa0beafa6..7002c61662 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Ransomware + - Windows Registry Abuse context: - Source:Endpoint - Stage:Defense Evasion diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 0b9c9a666a..4aace03422 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 46e6ae974a..b5b16d85d0 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 6bd536f000..b55567d231 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index f3249790cf..15558e4857 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 0eab87bdf4..dcd559b377 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 680a0c6b9d..f4d6e75115 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 43b1c849c4..bd0cb4a173 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Ransomware + - Windows Registry Abuse context: - Source:Endpoint - Stage:Defense Evasion diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 8c941d2d33..f103d447f3 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index b877e1e320..cfe318454b 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 9750e3c9bf..4b38910f2a 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 3cc9548329..7274da1be8 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Suspicious Windows Registry Activities + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 4e7b2ba1cc..17512b19ff 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -38,6 +38,7 @@ references: tags: analytic_story: - XMRig + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 48571a6474..27e511a6ca 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -41,6 +41,7 @@ tags: - Windows Defense Evasion Tactics - Ransomware - Revil Ransomware + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 511a800e6b..1ec1b145e4 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index a13bbf1356..6ea9d3374a 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 38b5b4ed45..1784fcf94e 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -33,6 +33,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 4facc01d6c..9194625692 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - IceID + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index a68caa4bf1..362e10f41e 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 83e322d3a9..dd31cbbe30 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index fcfd0eaf39..cec67662fe 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -26,6 +26,7 @@ tags: - Windows Defense Evasion Tactics - Suspicious Windows Registry Activities - Remcos + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 6b53a267c5..552d04ef06 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 3d82270f99..3c65b3339d 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index e95c303816..897386f6a7 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -34,6 +34,7 @@ references: tags: analytic_story: - Prohibited Traffic Allowed or Protocol Mismatch + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index e307ea92e9..828b657127 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -38,6 +38,7 @@ references: tags: analytic_story: - Credential Dumping + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 3c83adba74..960f779de5 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 1414f44b3b..e4c6563593 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -41,6 +41,7 @@ tags: - Windows Defense Evasion Tactics - IcedID - Living Off The Land + - Windows Registry Abuse automated_detection_testing: passed confidence: 100 context: diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index ee7c8d8675..7948f3ac6b 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -38,6 +38,7 @@ references: tags: analytic_story: - XMRig + - Windows Registry Abuse confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 0366226092..279433dd8c 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -28,6 +28,7 @@ tags: - Ransomware - Revil Ransomware - BlackMatter Ransomware + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 7886684076..99441750e0 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 58c061d3d3..7ef622f83c 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 70a0fd5f3a..c5a14cb897 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -55,6 +55,7 @@ tags: - 'Emotet Malware DHS Report TA18-201A ' - IcedID - Remcos + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index a527c4723a..9f5e9bb69b 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -39,6 +39,7 @@ tags: - Windows Privilege Escalation - Suspicious Windows Registry Activities - Cloud Federated Credential Abuse + - Windows Registry Abuse cis20: - CIS 8 confidence: 95 diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index c052b8dd1e..6f1c5913db 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Remcos + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 45755853a7..e0ae661df2 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -35,6 +35,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 4a3425a896..f6c6c22d88 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index ad8e6ebcfd..a217ae1d8d 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -37,6 +37,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index d648842916..e5438c4c95 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 62ec85ad68..515de1811b 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Windows Registry Abuse confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 79276bad4b..eaf42461b5 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Ransomware - Windows Defense Evasion Tactics + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 81d4761ae1..1d42ed5b62 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Ransomware + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 71b3c6d86e..2762afa09d 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -38,6 +38,7 @@ tags: - Data Destruction - Ransomware - Hermetic Wiper + - Windows Registry Abuse cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index f35dbfad90..b5e0d89819 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 91b4fb666a..835040e6b0 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - Ransomware + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index b653471017..1dcf8918c4 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Ransomware - Windows Defense Evasion Tactics + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 6525cd6863..af508a8574 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -30,6 +30,7 @@ tags: analytic_story: - Ryuk Ransomware - Windows Defense Evasion Tactics + - Windows Registry Abuse asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 254c7e1b74..6f5e2c783a 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -34,6 +34,7 @@ tags: analytic_story: - Ransomware - Windows Defense Evasion Tactics + - Windows Registry Abuse dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index abc36acbe0..35104fa672 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Hermetic Wiper + - Windows Registry Abuse cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 2aa6661a25..c41790becd 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -38,6 +38,7 @@ tags: - Active Directory Lateral Movement - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Windows Registry Abuse cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index ce5dab7776..fc659965a8 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -37,6 +37,7 @@ tags: analytic_story: - Windows Defense Evasion Tactics - Living Off The Land + - Windows Registry Abuse confidence: 90 context: - Source:Endpoint diff --git a/stories/windows_registry_abuse.yml b/stories/windows_registry_abuse.yml new file mode 100644 index 0000000000..9542fc6096 --- /dev/null +++ b/stories/windows_registry_abuse.yml @@ -0,0 +1,27 @@ +name: Windows Registry Abuse +id: 78df1df1-25f1-4387-90f9-c4ea31ce6b75 +version: 1 +date: '2022-03-17' +author: Teoderick Contreras, Splunk +description: Windows services are often used by attackers for persistence, privilege escalation, + lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and + payload impact. This Analytic Story helps you monitor your environment for indications + that Windows registry are being modified or created in a suspicious manner. +narrative: Windows Registry is one of the powerful and yet still mysterious Windows features + that can tweak or manipulate Windows policies and low-level configuration settings. + Because of this capability, most malware, adversaries or threat actors abuse this + hierarchical database to do their malicious intent on a targeted host or network environment. + In these cases, attackers often use tools to create or modify registry in ways that are not + typical for most environments, providing opportunities for detection. +references: +- https://attack.mitre.org/techniques/T1112/ +- https://redcanary.com/blog/windows-registry-attacks-threat-detection/ +tags: + analytic_story: Windows Registry Abuse + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From ff49b713b0f74b3c7cf80f6ac9fef5f778c52cf6 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 21 Mar 2022 09:24:42 +0100 Subject: [PATCH 4/4] add_story_and_minor_fix --- detections/endpoint/remcos_client_registry_install_entry.yml | 1 + tests/endpoint/remcos_client_registry_install_entry.test.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 6f1c5913db..5028c90de0 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -35,6 +35,7 @@ tags: context: - Source:Endpoint dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log impact: 90 kill_chain_phases: diff --git a/tests/endpoint/remcos_client_registry_install_entry.test.yml b/tests/endpoint/remcos_client_registry_install_entry.test.yml index 72235c0da3..8bb411c7aa 100644 --- a/tests/endpoint/remcos_client_registry_install_entry.test.yml +++ b/tests/endpoint/remcos_client_registry_install_entry.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: remcos_registry_entry.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog