Branch was auto-updated.

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
+  - Windows Registry Abuse
   confidence: 30
   context:
   - Source:Endpoint

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -39,6 +39,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - DarkSide Ransomware
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/auto_admin_logon_registry_entry.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - BlackMatter Ransomware
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/change_default_file_association.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_amsi_through_registry.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Windows Registry Abuse
   context:
   - Source:Endpoint
   - Stage:Defense Evasion

detections/endpoint/disable_defender_antivirus_registry.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_defender_enhanced_notification.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_defender_mpengine_registry.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disable_etw_through_registry.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Windows Registry Abuse
   context:
   - Source:Endpoint
   - Stage:Defense Evasion

detections/endpoint/disable_registry_tool.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_security_logs_using_minint_registry.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_show_hidden_files.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_uac_remote_restriction.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Suspicious Windows Registry Activities
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -41,6 +41,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Ransomware
   - Revil Ransomware
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/disable_windows_smartscreen_protection.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/disabling_cmd_application.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/disabling_controlpanel.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/disabling_defender_services.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - IceID
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/disabling_norun_windows_app.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/disabling_remote_user_account_control.yml

@@ -26,6 +26,7 @@ tags:
   - Windows Defense Evasion Tactics
   - Suspicious Windows Registry Activities
   - Remcos
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 70
   context:
   - Source:Endpoint
@@ -51,8 +52,7 @@ tags:
   message: The Windows registry was modified to disable system restore on $dest$ by
     $user$.
   mitre_attack_id:
-  - T1562.001
-  - T1562
+  - T1490
   observable:
   - name: user
     type: User

detections/endpoint/disabling_task_manager.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/enable_wdigest_uselogoncredential_registry.yml

@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/etw_registry_disabled.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/eventvwr_uac_bypass.yml

@@ -41,6 +41,7 @@ tags:
   - Windows Defense Evasion Tactics
   - IcedID
   - Living Off The Land
+  - Windows Registry Abuse
   automated_detection_testing: passed
   confidence: 100
   context:

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -38,6 +38,7 @@ references:
 tags:
   analytic_story:
   - XMRig
+  - Windows Registry Abuse
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/modification_of_wallpaper.yml

@@ -28,6 +28,7 @@ tags:
   - Ransomware
   - Revil Ransomware
   - BlackMatter Ransomware
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/modify_acl_permission_to_files_or_folder.yml

@@ -1,9 +1,9 @@
 name: Modify ACL permission To Files Or Folder
 id: 7e8458cc-acca-11eb-9e3f-acde48001122
-version: 1
-date: '2021-05-04'
+version: 2
+date: '2022-03-17'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic identifies suspicious modification of ACL permission to
@@ -14,9 +14,9 @@ description: This analytic identifies suspicious modification of ACL permission
   no permission to do so.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe"
-  OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe"
-  AND (Processes.process = "*/G everyone:*"  OR Processes.process = "*/G SYSTEM:*")
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe"
+  OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe")
+  AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*"  OR Processes.process = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*")
   by Processes.parent_process_name Processes.process_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `modify_acl_permission_to_files_or_folder_filter`'

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Suspicious Windows Registry Activities
   - Windows Persistence Techniques
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/registry_keys_for_creating_shim_databases.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Suspicious Windows Registry Activities
   - Windows Persistence Techniques
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -55,6 +55,7 @@ tags:
   - 'Emotet Malware  DHS Report TA18-201A '
   - IcedID
   - Remcos
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -39,6 +39,7 @@ tags:
   - Windows Privilege Escalation
   - Suspicious Windows Registry Activities
   - Cloud Federated Credential Abuse
+  - Windows Registry Abuse
   cis20:
   - CIS 8
   confidence: 95

detections/endpoint/remcos_client_registry_install_entry.yml

@@ -30,10 +30,12 @@ references:
 tags:
   analytic_story:
   - Remcos
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint
   dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log
   impact: 90
   kill_chain_phases:

detections/endpoint/revil_registry_entry.yml

@@ -35,6 +35,7 @@ tags:
   analytic_story:
   - Ransomware
   - Revil Ransomware
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/screensaver_event_trigger_execution.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/sdclt_uac_bypass.yml

@@ -37,6 +37,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/silentcleanup_uac_bypass.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

detections/endpoint/time_provider_persistence_registry.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
+  - Windows Registry Abuse
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Ransomware
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_disable_logoff_button_through_registry.yml

@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -38,6 +38,7 @@ tags:
   - Data Destruction
   - Ransomware
   - Hermetic Wiper
+  - Windows Registry Abuse
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/windows_disable_notification_center.yml

@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_disable_shutdown_button_through_registry.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Ransomware
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml

@@ -38,6 +38,7 @@ tags:
   analytic_story:
   - Ransomware
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_disableantispyware_reg.yml

@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Ryuk Ransomware
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/windows_hide_notification_features_through_registry.yml

@@ -34,6 +34,7 @@ tags:
   analytic_story:
   - Ransomware
   - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
   kill_chain_phases:

detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Hermetic Wiper
+  - Windows Registry Abuse
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -38,6 +38,7 @@ tags:
   - Active Directory Lateral Movement
   - Suspicious Windows Registry Activities
   - Windows Persistence Techniques
+  - Windows Registry Abuse
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/wsreset_uac_bypass.yml

@@ -37,6 +37,7 @@ tags:
   analytic_story:
   - Windows Defense Evasion Tactics
   - Living Off The Land
+  - Windows Registry Abuse
   confidence: 90
   context:
   - Source:Endpoint

stories/windows_registry_abuse.yml

@@ -0,0 +1,27 @@
+name: Windows Registry Abuse
+id: 78df1df1-25f1-4387-90f9-c4ea31ce6b75
+version: 1
+date: '2022-03-17'
+author: Teoderick Contreras, Splunk
+description: Windows services are often used by attackers for persistence, privilege escalation,  
+  lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and 
+  payload impact. This Analytic Story helps you monitor your environment for indications 
+  that Windows registry are being modified or created in a suspicious manner.
+narrative: Windows Registry is one of the powerful and yet still mysterious Windows features 
+  that can tweak or manipulate Windows policies and low-level configuration settings. 
+  Because of this capability,  most malware, adversaries or threat actors abuse this 
+  hierarchical database to do their malicious intent on a targeted host or network environment. 
+  In these cases, attackers often use tools to create or modify registry in ways that are not 
+  typical for most environments, providing opportunities for detection.
+references:
+- https://attack.mitre.org/techniques/T1112/
+- https://redcanary.com/blog/windows-registry-attacks-threat-detection/
+tags:
+  analytic_story: Windows Registry Abuse
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/remcos_client_registry_install_entry.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: remcos_registry_entry.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog