From 8020e90e6d6485079fa2b0261fa6aef87accb317 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 10 Apr 2025 11:05:36 -0500 Subject: [PATCH] Add output fields, tighten up outputs --- .../endpoint/windows_runmru_command_execution.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index f71133e44c..d930abc702 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -16,13 +16,7 @@ description: The following analytic detects modifications to the Windows RunMRU If confirmed malicious, this could indicate an attacker using indirect command execution techniques for defense evasion or persistence. The detection excludes MRUList value changes to focus on actual command entries. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" - NOT Registry.registry_key_name="*\\MRUList" by Registry.action Registry.dest Registry.process_guid - Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name - Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type - Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -81,6 +75,8 @@ tags: - Splunk Cloud security_domain: endpoint cve: [] + atomic_guid: + - de323a93-2f18-4bd5-ba60-d6fca6aeff76 tests: - name: True Positive Test attack_data: