SafeBoot

detections/endpoint/start_up_during_safe_mode_boot.yml

@@ -1,70 +0,0 @@
-name: Start Up During Safe Mode Boot
-id: c6149154-c9d8-11eb-9da7-acde48001122
-version: 2
-date: '2022-01-26'
-author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
-description: This search is to detect a modification or registry add to the safeboot
-  registry as an autostart mechanism. This technique was seen in some ransomware to
-  automatically execute its code upon a safe mode boot.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
-  where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`
-  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly`
-  count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
-  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
-  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
-  proc_guid | fields _time dest user parent_process_name parent_process process_name
-  process_path process proc_guid registry_path registry_value_name registry_value_data]
-  | table _time dest user parent_process_name parent_process process_name process_path
-  process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: updated windows application needed in safe boot may used this
-  registry
-references:
-- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
-tags:
-  analytic_story:
-  - Ransomware
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
-  impact: 60
-  kill_chain_phases:
-  - Exploitation
-  message: Safeboot registry $registry_path$ was added or modified with a new value
-    $registry_value_name$ on $dest$
-  mitre_attack_id:
-  - T1547.001
-  - T1547
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  risk_score: 42
-  security_domain: endpoint
-  supported_tas:
-  - Splunk_TA_microsoft_sysmon
-  asset_type: Endpoint

detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml

@@ -0,0 +1,78 @@
+name: 'Windows Registry Modification for Safe Mode Persistence'
+id: c6149154-c9d8-11eb-9da7-acde48001122
+version: 3
+date: '2022-03-31'
+author: Teoderick Contreras, Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a modification or registry add to the safeboot registry as an autostart mechanism. This technique is utilized by adversaries to persist a driver or service into Safe Mode. Two keys are monitored in this analytic,  Minimal and Network. 
+  adding values to Minimal will load into Safe Mode and by adding into Network it will provide the service or drive the ability to perform network connections in Safe Mode. 
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
+  where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*")
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
+  | `drop_dm_object_name(Registry)` 
+  | join process_guid _time 
+  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+  | `drop_dm_object_name(Processes)`]
+  | table
+  _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `windows_registry_modification_for_safe_mode_persistence_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+known_false_positives: updated windows application needed in safe boot may used this
+  registry
+references:
+- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
+- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md
+- https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/
+tags:
+  analytic_story:
+  - Ransomware
+  - Windows Registry Abuse
+  - Windows Rootkits
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Safeboot registry $registry_path$ was added or modified with a new value
+    $registry_value_name$ on $dest$
+  mitre_attack_id:
+  - T1547.001
+  - T1547
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process
+  - Processes.dest
+  - Processes.process_guid 
+  risk_score: 42
+  security_domain: endpoint
+  supported_tas:
+  - Splunk_TA_microsoft_sysmon
+  asset_type: Endpoint

tests/endpoint/windows_registry_modification_for_safe_mode_persistence.test.yml

@@ -1,7 +1,7 @@
-name: Start Up During Safe Mode Boot Unit Test
+name: Windows Registry Modification for Safe Mode Persistence Unit Test
 tests:
-- name: Start Up During Safe Mode Boot
-  file: endpoint/start_up_during_safe_mode_boot.yml
+- name: 'Windows Registry Modification for Safe Mode Persistence'
+  file: endpoint/windows_registry_modification_for_safe_mode_persistence.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: -24h
   latest_time: now