diff --git a/.vscode/security-content.code-snippets b/.vscode/security-content.code-snippets index 2541633abf..456d9e148c 100644 --- a/.vscode/security-content.code-snippets +++ b/.vscode/security-content.code-snippets @@ -327,6 +327,24 @@ "`process_netsh`" ], "description": "netsh macro" + }, + + "date version": { + "prefix": "date version", + "body": [ + "version: 4", + "date: '2023-04-27'", + ], + "description": "date version" + }, + + "time": { + "prefix": "time", + "body": [ + "| `security_content_ctime(firstTime)`", + "| `security_content_ctime(lastTime)`", + ], + "description": "time" } } \ No newline at end of file diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 8a8f458623..35f2c90f73 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 -version: 3 -date: '2023-04-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -14,18 +14,10 @@ description: This analytic is to detect a suspicious modification of the active valid setup installer that creating or modifying this registry. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active - Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -62,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 7cf4de2234..d6f5b44704 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,19 +13,11 @@ description: this search is to detect a suspicious registry modification to impl premise. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" - AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= - DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -55,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 23d0479ab7..b814456469 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 4 -date: '2022-11-14' +version: 5 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,19 +11,11 @@ description: This analytic detects a potential suspicious modification of firewa by allowing the traffic in a firewall rule. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = - "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_inbound_traffic_by_firewall_rule_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -60,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 8273341342..525c674c38 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,19 +12,11 @@ description: This analytic identifies a potential privilege escalation attempt t machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data - = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_operation_with_consent_admin_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -60,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 289e750230..f2b3be250e 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -1,7 +1,7 @@ name: Auto Admin Logon Registry Entry id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -13,19 +13,12 @@ description: this search is to detect a suspicious registry modification to impl premise. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" - AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) - BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -56,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 18fc827a2b..c1a1e0e001 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,28 +1,22 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute - payload with minimal alert as much as possible. + payload with minimal alert as much as possible. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" - Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path - Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -54,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index d3eef66b5f..261fd5cd6b 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,19 +12,12 @@ description: This particular behavior is typically executed when an adversary or any further file modifications. Endpoint should be isolated. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name - IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) - BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -58,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 8cdfbc4e7d..11fa687a58 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,28 +1,22 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP -description: This analytic is intended to detect a suspicious modification of the - Windows registry to disable a Windows Defender feature. This technique is intended - to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen - feature where it blocks suspicious files the first time seen on the host. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name - = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h - Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`' +description: This analytic is intended to detect a suspicious modification of the Windows registry to disable + a Windows Defender feature. This technique is intended to bypass or evade detection from + Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks + suspicious files the first time seen on the host. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_blockatfirstseen_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 712292d422..7e74e914c8 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,19 +12,12 @@ description: This particular behavior is typically executed when an adversary or any further file modifications. Endpoint should be isolated. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" - Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) - BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `disable_defender_mpengine_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical @@ -58,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 6b6e7d0c39..da76151b74 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,7 +1,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of re Defender telemetry. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -58,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index c2306d01f3..f054852b01 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of th that submits samples for further analysis. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 945cf9ac80..3303cee687 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -1,7 +1,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable ETW payload with minimal alert as much as possible. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -53,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 15d35b9ef1..a2999d35ef 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,7 +1,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search identifies modification of registry to disable the rege and defense evasion. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -53,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index d360153028..e083f54d2a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,7 +1,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,16 +11,10 @@ description: This analytic is to detect a suspicious registry modification to di will not log any event to the Security Log data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -54,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 20694e7832..c8b289b0eb 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,7 +1,7 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,19 +11,13 @@ description: The following analytic is to identify a modification in the Windows on the infected machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 4a38463c43..d728d2f541 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -1,7 +1,7 @@ name: Disable UAC Remote Restriction id: 9928b732-210e-11ec-b65e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious modification of registry to gain privilege escalation. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" ) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -58,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 79b7426bd4..b1df2a632d 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,7 +1,7 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunkk status: production type: TTP @@ -12,18 +12,12 @@ description: This analytic detects a suspicious registry modification to disable implant in compromised systems. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -54,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 253ae0f0e0..99043e7359 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 3 -date: '2023-04-25' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,11 +10,7 @@ description: This search is to identifies a modification in registry to disable seen in RAT, bot, or Trojan to disable AV to evade detections. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= @@ -25,9 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -62,15 +56,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 97e50644e2..0b78c8fe18 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,7 +1,7 @@ name: Disable Windows SmartScreen Protection id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: The following search identifies a modification of registry to disab downloading other of its component or other payload. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= "Off") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 57fc6ee1c6..ec95a0ef58 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,7 +1,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable cmd to traverse on directory and files. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 02bee212a7..f4cc6bd865 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,7 +1,7 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,17 +10,11 @@ description: this search is to identify registry modification to disable control persistence removed on the infected machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -55,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 1564b9ae86..a0b497f6f6 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -1,7 +1,7 @@ name: Disabling Defender Services id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,19 +12,13 @@ description: This particular behavior is typically executed when an adversaries any further file modifications. Endpoint should be isolated. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -60,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 4e08ec2fe1..f01f61d0c3 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -1,7 +1,7 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search is to identify registry modification to disable folder fake file extensions. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 1e72bfffdc..4d3e5e7bf6 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,7 +1,7 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search is to identify modification of registry to disable run known application run easily through run shortcut. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -59,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index bb61fdacac..c09ba33994 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -1,7 +1,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,20 +11,14 @@ description: The following search identifies the modification of registry relate their infection on the box. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -59,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index dece1f22e2..81ceda93eb 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -1,7 +1,7 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This search is to identifies modification of registry to disable th their process. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +50,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 2886fe41d1..aabfe80855 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -1,7 +1,7 @@ name: Enable RDP In Other Port Number id: 99495452-b899-11eb-96dc-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,18 +11,11 @@ description: This search is to detect a modification to registry to enable rdp t control of it. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 8d2949d41b..4e3ebec80d 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,7 +1,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,18 +12,11 @@ description: This analytic is to detect a suspicious registry modification to en crendential of the host so it must be a good pivot for credential dumping techniques. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" - Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data - = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -59,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name @@ -79,6 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index f794d71e3f..f7e1e25e30 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,7 +1,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 3 -date: '2023-04-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,17 +10,11 @@ description: This analytic is to detect a registry modification to disable ETW f its execution from audit logs. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -59,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 98cb306ffa..20019c2fcd 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -1,7 +1,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This analytic identifies a suspicious registry modification to hide on that said machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -64,15 +58,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index 5caeb160b8..f2f343371f 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -1,7 +1,7 @@ name: Linux Account Manipulation Of SSH Config and Keys id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,15 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | - `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid |join proc_guid, - _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.parent_process_name != unknown by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid file_name file_path - action _time parent_process_name parent_process process_path dest user | `linux_account_manipulation_of_ssh_config_and_keys_filter`' + `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_account_manipulation_of_ssh_config_and_keys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -63,15 +57,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: @@ -79,4 +64,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index e913a99722..4e851873b7 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Cron Jobs id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,10 @@ description: This analytic is to detect a deletion of cron job in a linux machin data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path - ="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_cron_jobs_filter`' + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -65,15 +57,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 101746595c..52b9b4bbaf 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,15 +20,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_init_daemon_script_filter`' + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_init_daemon_script_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -66,15 +59,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: @@ -82,4 +66,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 840365bffa..e5254716b4 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Services id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,16 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path = "*.service" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_services_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -68,15 +61,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint tests: @@ -84,4 +68,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 3454454c7c..e1b58f85e6 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -1,7 +1,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,15 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid - Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid - |join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.parent_process_name != unknown by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid file_name file_path - action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_ssl_certificate_filter`' + Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_ssl_certificate_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -64,15 +58,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: @@ -80,4 +65,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index a5e880b660..7e520ee8e6 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -1,7 +1,7 @@ name: Linux High Frequency Of File Deletion In Boot Folder id: e27fbc5d-0445-4c4a-bc39-87f060d5c602 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", - "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid action _time deletedFileNames - deletedFilePath numOfDelFilePath parent_process_name parent_process process_path - dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -66,15 +58,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 80 security_domain: endpoint tests: @@ -82,4 +65,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index d1dbe4022e..59eb6fc4dd 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -1,7 +1,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", - "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid action _time deletedFileNames - deletedFilePath numOfDelFilePath parent_process_name parent_process process_path - dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -65,15 +57,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 23eb5d4cb0..9be7147ba6 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,7 +1,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 4 -date: '2022-11-14' +version: 5 +date: '2023-04-27' author: Steven Dick, Bhavin Patel, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: This search looks for registry activity associated with modificatio with elevated (SYSTEM) permissions and will persist after reboot. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -54,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 8ee8d7912b..365a042cf3 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,7 +1,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 5 -date: '2022-11-14' +version: 6 +date: '2023-04-27' author: Steven Dick, Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk status: production type: TTP @@ -9,17 +9,10 @@ description: This search looks for registry activity associated with application shims, which can be leveraged by attackers for various nefarious purposes. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 93402a1713..b93685b9fe 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 6 -date: '2023-04-14' +version: 7 +date: '2023-04-27' author: Steven Dick, David Dorsey, Teoderick Contreras, Splunk status: production type: TTP @@ -11,18 +11,11 @@ description: This search looks for modifications to registry keys that can be us to benign system binaries. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -63,15 +56,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 1250cb8987..853c30860a 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,7 +1,7 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 3 -date: '2023-04-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: This analytic is to detect a suspicious modification of time provid modified by normal user or even an admin. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -61,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 0f3ab8ab88..e32b32de0d 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Defender Exclusion Registry Entry id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -13,17 +13,10 @@ description: This analytic will detect a suspicious process that modify a regist defense evasion and to look further for events after this behavior. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -61,15 +54,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 148d05c67d..9392c85e6e 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,17 +16,11 @@ description: This analytic is to detect a suspicious registry modification to di is needed to minimized false positive. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -58,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 3366c63fd5..5c936dac83 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious registry modification to di to the compromised host. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -54,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index b62060951d..b0c94e2d27 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,12 @@ description: This analytic is to detect a suspicious registry modification to di filter of machine and users that can modify this registry is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -61,15 +55,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 4167f9f3a2..7c72079b38 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,7 +1,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 1 -date: '2023-04-14' +version: 2 +date: '2023-04-27' author: Michael Haag, Splunk status: production type: TTP @@ -18,14 +18,9 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` - |join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process - process_name process_path process process_guid registry_path registry_value_name - registry_value_data registry_key_name] | table _time dest user parent_process_name - parent_process process_name process_path process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`' + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` @@ -70,19 +65,12 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - - Filesystem.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 90 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index efb43bfe2b..003d3255e9 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -1,7 +1,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,17 +12,11 @@ description: The following search identifies a modification of registry to disab downloading other of its component or other payload. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -55,15 +49,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 002f8f2938..925d61e96c 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,18 +14,12 @@ description: This analytic is to detect a suspicious registry modification to di users that can modify this registry is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 26333b81fc..9f258469fd 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,12 +14,8 @@ description: This analytic is to detect a suspicious registry modification to di allowed doing this is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -56,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 7d016b3240..8366ad24f9 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,19 +13,12 @@ description: This analytic is to detect a suspicious registry modification to hi In this scenario filter is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index a7ffd67283..feca71daa4 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,7 +1,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 2 -date: '2023-04-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -14,17 +14,11 @@ description: This analytic is to look for suspicious registry modification relat NTFS file system. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -56,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index 304464a7ae..6706a0612b 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -1,10 +1,10 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 -version: 1 -date: '2022-03-31' +version: 2 +date: '2023-04-27' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly description: The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to @@ -20,11 +20,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] - | table _time dest user process_name process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_registry_certificate_added_filter`' + `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_certificate_added_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. @@ -62,11 +61,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.process_guid risk_score: 42 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index 8a2b7a0067..e6c979fe54 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -1,7 +1,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 3 -date: '2022-03-31' +version: 4 +date: '2023-04-27' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,11 +17,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] - | table _time dest user process_name process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`' + `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_modification_for_safe_mode_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response @@ -63,11 +62,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.process_guid risk_score: 42 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 4d53e97e82..4305460aa6 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -13,17 +13,11 @@ description: This analytic is to look for suspicious modification or creation of to create a service entry using registry ImagePath. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -57,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name