From 689caaf2acaac6f37e2d4001c7d777ea45e524de Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 11 Jul 2023 16:46:13 -0500 Subject: [PATCH] Updated description --- .../endpoint/windows_modify_registry_risk_behavior.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_modify_registry_risk_behavior.yml b/detections/endpoint/windows_modify_registry_risk_behavior.yml index ed6e0d1d82..5b195dcaac 100644 --- a/detections/endpoint/windows_modify_registry_risk_behavior.yml +++ b/detections/endpoint/windows_modify_registry_risk_behavior.yml @@ -6,9 +6,8 @@ author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] -description: The following correlation identifies a distinct amount of analytics associated - with the Windows Modify Registry analytic technique ID that identify potentially suspicious - behavior. +description: The following analytic detects the triggering of a 3 or higher number of distinct analytics associated + with a Mitre ID T1112 which is modification of registry information, which could be a sign of multiple malicious registry modifications made on a host. Malicious actors often manipulate the Windows Registry to conceal vital configuration details within specific Registry keys. They exploit this technique to obfuscate their activities, eliminate traces of their presence during cleanup operations, and facilitate persistent access and execution of malicious code. search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,