From d26c6afa10266f132e037f0d68cfd06badcb1a7f Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 15 May 2023 12:13:40 +0200 Subject: [PATCH 1/7] atomic_tag_redline --- .../endpoint/windows_modify_registry_auto_update_notif.yml | 1 + ...windows_modify_registry_disable_windefender_notifications.yml | 1 + .../windows_modify_registry_do_not_connect_to_win_update.yml | 1 + .../windows_modify_registry_no_auto_reboot_with_logon_user.yml | 1 + detections/endpoint/windows_modify_registry_no_auto_update.yml | 1 + .../endpoint/windows_modify_registry_tamper_protection.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index f9895cc7a6..891d77c98d 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -35,6 +35,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: A registry modification in Windows auto update notification on $dest$ diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index 0f8ea8a05d..7e38a8b3c5 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -33,6 +33,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to disable Windows Defender notification on $dest$ diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index e7626c0387..f96d15a569 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -37,6 +37,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: a registry modification in Windows auto update configuration in $dest$ diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index acc6dd1b97..e3ed7a0357 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -35,6 +35,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 30 impact: 30 message: A registry modification in Windows auto update configuration on $dest$ diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 6f2e7be2b1..53c0e96f02 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -35,6 +35,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification in Windows auto update configuration on $dest$ diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index 058432a56e..c33e8e0ea6 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -33,6 +33,7 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint + atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to tamper Windows Defender protection on $dest$ From 23c615f96d963d0a4e3aa2c4b7cbfa211f49789a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:16:21 +0200 Subject: [PATCH 2/7] Update windows_modify_registry_auto_update_notif.yml --- .../endpoint/windows_modify_registry_auto_update_notif.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 891d77c98d..cb2b417336 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -35,7 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: A registry modification in Windows auto update notification on $dest$ From f028b1a8f0430e613d331d03610947ebd7cedcd2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:16:36 +0200 Subject: [PATCH 3/7] Update windows_modify_registry_disable_windefender_notifications.yml --- ...ndows_modify_registry_disable_windefender_notifications.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index 7e38a8b3c5..0524d51310 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -33,7 +33,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to disable Windows Defender notification on $dest$ From 9b3d8e8b891518a8ea9dbee5fbd0df9f4e361e11 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:16:52 +0200 Subject: [PATCH 4/7] Update windows_modify_registry_do_not_connect_to_win_update.yml --- .../windows_modify_registry_do_not_connect_to_win_update.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index f96d15a569..fbe6a51061 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -37,7 +37,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 50 impact: 50 message: a registry modification in Windows auto update configuration in $dest$ From 613293d3f3bf6c444f6055386594b22dd105b270 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:17:10 +0200 Subject: [PATCH 5/7] Update windows_modify_registry_no_auto_reboot_with_logon_user.yml --- .../windows_modify_registry_no_auto_reboot_with_logon_user.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index e3ed7a0357..af7aa24426 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -35,7 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 30 impact: 30 message: A registry modification in Windows auto update configuration on $dest$ From 439e3eae26f469fd473836421a8faa3bf1aba7c9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:17:26 +0200 Subject: [PATCH 6/7] Update windows_modify_registry_no_auto_update.yml --- detections/endpoint/windows_modify_registry_no_auto_update.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 53c0e96f02..95972af220 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -35,7 +35,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification in Windows auto update configuration on $dest$ From e171050118480c9597a8a7de8678400d726ccb49 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 15 May 2023 12:17:44 +0200 Subject: [PATCH 7/7] Update windows_modify_registry_tamper_protection.yml --- .../endpoint/windows_modify_registry_tamper_protection.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index c33e8e0ea6..b635a29529 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -33,7 +33,8 @@ tags: analytic_story: - RedLine Stealer asset_type: Endpoint - atomic_guid: 12e03af7-79f9-4f95-af48-d3f12f28a260 + atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 confidence: 70 impact: 70 message: A registry modification to tamper Windows Defender protection on $dest$