admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-01-31 11:29:55 -08:00
committed by GitHub
parent 38f3410239 43a1e7269c
commit 80267efee8
10 changed files with 136 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/disable_etw_through_registry.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 1
date: '2021-06-22'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -10,11 +10,17 @@ description: this search is to identify modification in registry to disable ETW
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
detections/endpoint/disable_registry_tool.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disable Registry Tool
id: cd2cf33c-9201-11eb-a10a-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,11 +11,17 @@ description: This search identifies modification of registry to disable the rege
knife in analyzing registry, malware such as RAT or trojan Spy disable this application
to prevent the removal of their registry entry such as persistence, file less components
and defense evasion.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_registry_tool_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
detections/endpoint/disable_security_logs_using_minint_registry.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 1
date: '2021-10-05'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -10,11 +10,17 @@ description: This analytic is to detect a suspicious registry modification to di
security audit logs. This technique was shared by a researcher to disable Security
logs of windows by adding this registry. The Windows will think it is WinPE and
will not log any event to the Security Log
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Control\\MiniNt\\*"
by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name
Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\Control\\MiniNt\\*"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
detections/endpoint/disable_show_hidden_files.yml
+15 -9
View File
@@ -1,7 +1,7 @@
name: Disable Show Hidden Files
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: TTP
datamodel:
@@ -10,13 +10,19 @@ description: The following analytic is to identify a modification in the Windows
to prevent users from seeing all the files with hidden attributes. This event or
techniques are known on some worm and trojan spy malware that will drop hidden files
on the infected machine.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001")
OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000")
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
detections/endpoint/disable_uac_remote_restriction.yml
+12 -8
View File
@@ -1,7 +1,7 @@
name: Disable UAC Remote Restriction
id: 9928b732-210e-11ec-b65e-acde48001122
version: 1
date: '2021-09-29'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,12 +11,16 @@ description: This analytic is to detect a suspicious modification of registry to
attacker may modify this registry value to bypassed UAC feature of windows host.
This is a good indicator that some tries to bypassed UAC to suspicious process or
gain privilege escalation.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy"
Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_uac_remote_restriction_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
detections/endpoint/disable_windows_app_hotkeys.yml
+13 -9
View File
@@ -1,7 +1,7 @@
name: Disable Windows App Hotkeys
id: 1490f224-ad8b-11eb-8c4f-acde48001122
version: 1
date: '2021-05-05'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,13 +11,17 @@ description: This analytic detects a suspicious registry modification to disable
used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
This technique is used to impair the analyst in analyzing and removing the attacker
implant in compromised systems.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name
= "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest
Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `disable_windows_app_hotkeys_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
detections/endpoint/disable_windows_behavior_monitoring.yml
+18 -14
View File
@@ -1,7 +1,7 @@
name: Disable Windows Behavior Monitoring
id: 79439cae-9200-11eb-a4d3-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -9,18 +9,22 @@ datamodel:
description: This search is to identifies a modification in registry to disable the
windows denfender real time behavior monitoring. This event or technique is commonly
seen in RAT, bot, or Trojan to disable AV to evade detections.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
"*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableScanOnRealtimeEnable" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path=
"*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path=
"*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time
Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001" by
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring"
OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem"
OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection"
OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_windows_behavior_monitoring_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
detections/endpoint/disable_windows_smartscreen_protection.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disable Windows SmartScreen Protection
id: 664f0fd0-91ff-11eb-a56f-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,11 +11,17 @@ description: The following search identifies a modification of registry to disab
early warning system against website that might engage in phishing attack or malware
distribution. This modification are seen in RAT malware to cover their tracks upon
downloading other of its component or other payload.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name
= "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= "Off"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
| `disable_windows_smartscreen_protection_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
detections/endpoint/disabling_cmd_application.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disabling CMD Application
id: ff86077c-9212-11eb-a1e6-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -10,11 +10,17 @@ description: this search is to identify modification in registry to disable cmd
application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
or deleting there samples through cmd application which is one of the tool of analyst
to traverse on directory and files.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
|`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
detections/endpoint/disabling_controlpanel.yml
+13 -7
View File
@@ -1,7 +1,7 @@
name: Disabling ControlPanel
id: 6ae0148e-9215-11eb-a94a-acde48001122
version: 1
date: '2021-03-31'
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -9,11 +9,17 @@ datamodel:
description: this search is to identify registry modification to disable control panel
window. This technique is commonly seen in malware to prevent their artifacts ,
persistence removed on the infected machine.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
| `drop_dm_object_name(Registry)`
|rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid
| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name]
| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
| `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure