From 76f05a1af14558945c327e564752b582b80b3b7c Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 6 Sep 2021 16:49:58 +0200 Subject: [PATCH 01/21] blackmatter_ransomware --- ...d_defaultuser_and_password_in_registry.yml | 59 +++++++++++++++++++ .../auto_admin_logon_registry_entry.yml | 59 +++++++++++++++++++ .../known_services_killed_by_ransomware.yml | 8 ++- .../endpoint/modification_of_wallpaper.yml | 1 + .../ransomware_notes_bulk_creation.yml | 1 + ...aultuser_and_password_in_registry.test.yml | 12 ++++ .../auto_admin_logon_registry_entry.test.yml | 12 ++++ 7 files changed, 149 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/add_defaultuser_and_password_in_registry.yml create mode 100644 detections/endpoint/auto_admin_logon_registry_entry.yml create mode 100644 tests/endpoint/add_defaultuser_and_password_in_registry.test.yml create mode 100644 tests/endpoint/auto_admin_logon_registry_entry.test.yml diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml new file mode 100644 index 0000000000..afaeed959b --- /dev/null +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -0,0 +1,59 @@ +name: Add DefaultUser And Password In Registry +id: d4a3eb62-0f1e-11ec-a971-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. + This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. + This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR Registry.registry_key_name= DefaultUserName + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml new file mode 100644 index 0000000000..66b1f1f595 --- /dev/null +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -0,0 +1,59 @@ +name: Auto Admin Logon Registry Entry +id: 1379d2b8-0f18-11ec-8ca3-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. + This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. + This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `auto_admin_logon_registry_entry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1552.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Credential Access + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index edca4aa62a..1330ba95d9 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -12,9 +12,10 @@ description: This search detects a suspicioous termination of known services kil the targetted files it wants to encrypts because of the open handle of those services to the targetted file. search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", - "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service - entered the stopped state*" | stats count min(_time) as firstTime max(_time) as - lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message dest Type + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `known_services_killed_by_ransomware_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints. @@ -26,6 +27,7 @@ references: tags: analytic_story: - Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 80 context: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 7ffb78901d..abbc9ace22 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -27,6 +27,7 @@ tags: analytic_story: - Ransomware - Revil Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 2b04d700cd..db1f7434ed 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Clop Ransomware - DarkSide Ransomware + - BlackMatter Ransomware automated_detection_testing: passed confidence: 90 context: diff --git a/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml new file mode 100644 index 0000000000..bc31abaa07 --- /dev/null +++ b/tests/endpoint/add_defaultuser_and_password_in_registry.test.yml @@ -0,0 +1,12 @@ +name: Add DefaultUser And Password In Registry Unit Test +tests: +- name: Add DefaultUser And Password In Registry + file: endpoint/add_defaultuser_and_password_in_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/auto_admin_logon_registry_entry.test.yml b/tests/endpoint/auto_admin_logon_registry_entry.test.yml new file mode 100644 index 0000000000..35e38cb16c --- /dev/null +++ b/tests/endpoint/auto_admin_logon_registry_entry.test.yml @@ -0,0 +1,12 @@ +name: Auto Admin Logon Registry Entry Unit Test +tests: +- name: Auto Admin Logon Registry Entry + file: endpoint/auto_admin_logon_registry_entry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 73ec31d559d652edc6b7ac965f89c6ee691385e7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 6 Sep 2021 16:55:08 +0200 Subject: [PATCH 02/21] blackMatter_ransomware --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index afaeed959b..f141c8176f 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` - | `auto_admin_logon_registry_entry_filter`' + | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure From 7dbd2e82bc6c06a92a2f0dfc2b39e7221f69ed99 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 07:47:09 +0000 Subject: [PATCH 03/21] Added detection testing service results inAuto Admin Logon Registry Entry --- .../auto_admin_logon_registry_entry.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 66b1f1f595..229e7fa1f1 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. - This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. - This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `auto_admin_logon_registry_entry_filter`' +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND + Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -38,22 +40,22 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest security_domain: endpoint impact: 70 confidence: 90 - # (impact * confidence)/100 risk_score: 63 - context: + context: - Source:Endpoint - Stage:Credential Access - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon - observable: + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 7cfee54f2df789bfdcf0778126e2eb483975bbc5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 07:49:18 +0000 Subject: [PATCH 04/21] Added detection testing service results inAdd DefaultUser And Password In Registry --- ...d_defaultuser_and_password_in_registry.yml | 42 ++++++++++--------- 1 file changed, 22 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index f141c8176f..ce8e2203bf 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -6,23 +6,25 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. - This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. - This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry - where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR Registry.registry_key_name= DefaultUserName - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `add_defaultuser_and_password_in_registry_filter`' +description: this search is to detect a suspicious registry modification to implement + auto admin logon to a host. This technique was seen in BlackMatter ransomware to + automatically logon to the compromise host after triggering a safemode boot to + continue encrypting the whole network. This behavior is not a common practice and + really a suspicious TTP or alert need to be consider if found within then network + premise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR + Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -38,22 +40,22 @@ tags: - Splunk Cloud required_fields: - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest + - Registry.registry_path + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 - context: + context: - Source:Endpoint - Stage:Credential Access - message: modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon - observable: + message: modified registry key $registry_key_name$ with registry value $registry_value_name$ + to prepare autoadminlogon + observable: - name: dest type: Endpoint role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 01cd109007f812d5ec3c09f0a346aa1b6a081e79 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:24:13 +0200 Subject: [PATCH 05/21] blackMatter_ransomware --- ...dedit_command_back_to_normal_mode_boot.yml | 66 +++++++++++++++++++ ...hange_to_safe_mode_with_network_config.yml | 66 +++++++++++++++++++ stories/ransomware_blackmatter.yml | 24 +++++++ ..._command_back_to_normal_mode_boot.test.yml | 12 ++++ ..._to_safe_mode_with_network_config.test.yml | 12 ++++ 5 files changed, 180 insertions(+) create mode 100644 detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml create mode 100644 detections/endpoint/change_to_safe_mode_with_network_config.yml create mode 100644 stories/ransomware_blackmatter.yml create mode 100644 tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml create mode 100644 tests/endpoint/change_to_safe_mode_with_network_config.test.yml diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml new file mode 100644 index 0000000000..545daa939f --- /dev/null +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -0,0 +1,66 @@ +name: Bcdedit Command Back To Normal Mode Boot +id: dc7a8004-0f18-11ec-8c54-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. + This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using + bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name + Processes.process Processes.parent_process_name Processes.dest Processes.user + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `bcdedit_command_back_to_normal_mode_boot_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml new file mode 100644 index 0000000000..af37653729 --- /dev/null +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -0,0 +1,66 @@ +name: Change To Safe Mode With Network Config +id: 81f1dce0-0f18-11ec-a5d7-acde48001122 +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. + This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using + bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe + Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.process_name + Processes.process Processes.parent_process_name Processes.dest Processes.user + |`drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `change_to_safe_mode_with_network_config_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - BlackMatter Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1490 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest + - Processes.user + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to force safemode boot the $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml new file mode 100644 index 0000000000..e3c6ead217 --- /dev/null +++ b/stories/ransomware_blackmatter.yml @@ -0,0 +1,24 @@ +name: Clop Ransomware +id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee +version: 1 +date: '2021-09-06' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the BlackMatter ransomware, including looking for file writes associated + with BlackMatter, force safe mode boot, autadminlogon account registry modification and more. +narrative: blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of + ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for + ransome of data and threaten deletion and exposure of exfiltrated data. +references: +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/ +- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/ +tags: + analytic_story: blackMatter Ransomware + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml new file mode 100644 index 0000000000..4a352d2e57 --- /dev/null +++ b/tests/endpoint/bcdedit_command_back_to_normal_mode_boot.test.yml @@ -0,0 +1,12 @@ +name: Bcdedit Command Back To Normal Mode Boot Unit Test +tests: +- name: Bcdedit Command Back To Normal Mode Boot + file: endpoint/bcdedit_command_back_to_normal_mode_boot.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/change_to_safe_mode_with_network_config.test.yml b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml new file mode 100644 index 0000000000..6c6dd8e13a --- /dev/null +++ b/tests/endpoint/change_to_safe_mode_with_network_config.test.yml @@ -0,0 +1,12 @@ +name: Change To Safe Mode With Network Config Unit Test +tests: +- name: Change To Safe Mode With Network Config + file: endpoint/change_to_safe_mode_with_network_config.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From a4e04374ad198f75b6b3ea4bb3dfae57e8251b8d Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:26:59 +0200 Subject: [PATCH 06/21] blackMatter_ransomware --- stories/ransomware_blackmatter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml index e3c6ead217..1263b8e239 100644 --- a/stories/ransomware_blackmatter.yml +++ b/stories/ransomware_blackmatter.yml @@ -1,4 +1,4 @@ -name: Clop Ransomware +name: blackMatter Ransomware id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' From ba61023e496166ab7d054b764e32ae7068d691a0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 7 Sep 2021 13:38:26 +0200 Subject: [PATCH 07/21] blackMatter_ransomware --- stories/ransomware_blackmatter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/ransomware_blackmatter.yml b/stories/ransomware_blackmatter.yml index 1263b8e239..8280c80e75 100644 --- a/stories/ransomware_blackmatter.yml +++ b/stories/ransomware_blackmatter.yml @@ -1,4 +1,4 @@ -name: blackMatter Ransomware +name: BlackMatter Ransomware id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' From e39b2ff3b9d1f80069bf560aa4bfacf7dd9dcfd5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 12:40:43 +0000 Subject: [PATCH 08/21] Added detection testing service results inBcdedit Command Back To Normal Mode Boot --- ...dedit_command_back_to_normal_mode_boot.yml | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 545daa939f..7373e931ba 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. - This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using - bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +description: This search is to detect a suspicious bcdedit commandline to configure + the host from safe mode back to normal boot configuration. This technique was seen + in blackMatter ransomware where it force the compromised host to boot in safe mode + to continue its encryption and bring back to normal boot using bcdedit deletevalue + command. This TTP can be a good alert for host that booted from safe mode forcefully + since it need to modify the boot configuration to bring it back to normal. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `bcdedit_command_back_to_normal_mode_boot_filter`' + Processes.process="*/deletevalue*" Processes.process="*{current}*" Processes.process="*safeboot*" + by Processes.process_name Processes.process Processes.parent_process_name Processes.dest + Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -41,20 +41,20 @@ tags: required_fields: - _time - Processes.process_name - - Processes.process + - Processes.process - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user + - Processes.parent_process + - Processes.dest + - Processes.user security_domain: endpoint impact: 50 confidence: 70 - # (impact * confidence)/100 risk_score: 35 context: - - Source:Endpoint - - Stage:Impact - message: bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ + - Source:Endpoint + - Stage:Impact + message: bcdedit process with commandline $process$ to bring back to normal boot + configuration the $dest$ observable: - name: user type: User @@ -63,4 +63,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 7c8da13fd8bf431ac986c52acce12fb1e4075a1c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 7 Sep 2021 12:43:25 +0000 Subject: [PATCH 09/21] Added detection testing service results inChange To Safe Mode With Network Config --- ...hange_to_safe_mode_with_network_config.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index af37653729..2bcd13640e 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -6,25 +6,25 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. - This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue its encryption and bring back to normal boot using - bcdedit deletevalue command. - This TTP can be a good alert for host that booted from safe mode forcefully since it need to modify the boot configuration to bring it back to normal. +description: This search is to detect a suspicious bcdedit commandline to configure + the host to boot in safe mode with network config. This technique was seen in blackMatter + ransomware where it force the compromised host to boot in safe mode to continue + its encryption and bring back to normal boot using bcdedit deletevalue command. + This TTP can be a good alert for host that booted from safe mode forcefully since + it need to modify the boot configuration to bring it back to normal. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe - Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" Processes.process="*network*" by Processes.process_name - Processes.process Processes.parent_process_name Processes.dest Processes.user - |`drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `change_to_safe_mode_with_network_config_filter`' + Processes.process="*/set*" Processes.process="*{current}*" Processes.process="*safeboot*" + Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name + Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - BlackMatter Ransomware @@ -41,19 +41,18 @@ tags: required_fields: - _time - Processes.process_name - - Processes.process + - Processes.process - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user + - Processes.parent_process + - Processes.dest + - Processes.user security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - - Source:Endpoint - - Stage:Impact + - Source:Endpoint + - Stage:Impact message: bcdedit process with commandline $process$ to force safemode boot the $dest$ observable: - name: user @@ -63,4 +62,5 @@ tags: - name: dest type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 69c0472d6f75153b7c90b9567bab24e815136647 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 7 Sep 2021 17:04:37 -0700 Subject: [PATCH 10/21] Revert "New automerge action and conditional on" --- .github/workflows/auto-merge.yml | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 5a7456bfab..96c30258b6 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -1,17 +1,13 @@ -name: automerge +name: auto-merge on: - pull_request: + pull_request_target: jobs: - automerge: + auto-merge: runs-on: ubuntu-latest steps: - - - name: Print the name of the actor - run: | - echo "The name of the actor is [${{ github.actor }}]" - - name: automerge - uses: "pascalgn/automerge-action@v0.14.3" - if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]' - env: - GITHUB_TOKEN: "${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}" \ No newline at end of file + - uses: actions/checkout@v2 + - uses: ahmadnassri/action-dependabot-auto-merge@v2 + with: + target: minor + github-token: ${{ secrets.AUTOMERGE }} From 6668e71b6f0c57f1762a99461d8ab570779c2a01 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 7 Sep 2021 21:44:44 -0400 Subject: [PATCH 11/21] updating base on suggestions from mschilt in issue 1528 --- .../registry_keys_used_for_persistence.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 5b4c33c081..d4981a39e1 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 5 -date: '2020-11-27' -author: David Dorsey, Splunk +version: 6 +date: '2021-09-07' +author: Jose Hernandez, David Dorsey, Splunk type: TTP datamodel: - Endpoint @@ -11,11 +11,18 @@ description: The search looks for modifications to registry keys that can be use search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* - OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* - OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows - NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) + OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" Registry.registry_key_name="Security Packages") + OR Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*" + OR (Registry.registry_path="*currentVersion\\Windows" Registry.registry_key_name="Load") + OR (Registry.registry_path="*\\CurrentVersion" Registry.registry_key_name="Svchost") + OR Registry.registry_path="*\\CurrentControlSet\Control\Session Manager" Registry.registry_key_name="BootExecute") + OR Registry.registry_path="*\\Software\\Run" Registry.registry_key_name="auto_update") by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data From a32955b9858a8d5ca7e5e41d600d697aa19d8f0c Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 7 Sep 2021 21:51:20 -0400 Subject: [PATCH 12/21] updating detection base on feedback from mschilt in issue 1527 --- .../system_information_discovery_detection.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index f1191ab224..ed90c3cbf4 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,7 +1,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 1 -date: '2020-10-12' +version: 2 +date: '2021-09-07' author: Patrick Bareiss, Splunk type: TTP datamodel: @@ -11,10 +11,10 @@ description: Detect system information discovery techniques used by attackers to search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user - Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` +Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)` | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest - > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime - by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + > 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime + by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From b2f96c1ff9786daa4bef3e27095b5eb2c17ce8ef Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Sep 2021 10:05:16 +0200 Subject: [PATCH 13/21] blackMatter_ransomware --- ..._by_app_connect_and_create_adsi_object.yml | 61 +++++++++++++++++++ ...pp_connect_and_create_adsi_object.test.yml | 12 ++++ 2 files changed, 73 insertions(+) create mode 100644 detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml create mode 100644 tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml new file mode 100644 index 0000000000..3a84973849 --- /dev/null +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -0,0 +1,61 @@ +name: SchCache Change By App Connect And Create ADSI Object +id: 991eb510-0fc6-11ec-82d3-acde48001122 +version: 1 +date: '2021-09-07' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. + Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. + If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. + We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. + having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. +search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) + |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `schcache_change_by_app_connect_and_create_adsi_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections. +references: +- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +tags: + analytic_story: + - blackMatter ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1087.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - TargetFilename + - EventCode + - process_id + - process_name + - Computer + security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - source:endpoint + - stage:Discovery + message: process $Image$ create a file $TargetFilename$ in host $Computer$ + observable: + - name: Computer + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml new file mode 100644 index 0000000000..b183b4b538 --- /dev/null +++ b/tests/endpoint/schcache_change_by_app_connect_and_create_adsi_object.test.yml @@ -0,0 +1,12 @@ +name: SchCache Change By App Connect And Create ADSI Object Unit Test +tests: +- name: SchCache Change By App Connect And Create ADSI Object + file: endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From c04a669b6b4cc1f4d29a5da5784fd71b7fcbcbbe Mon Sep 17 00:00:00 2001 From: root Date: Wed, 8 Sep 2021 08:29:03 +0000 Subject: [PATCH 14/21] Added detection testing service results inSchCache Change By App Connect And Create ADSI Object --- ..._by_app_connect_and_create_adsi_object.yml | 51 ++++++++++--------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index 3a84973849..195a869c7b 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -6,24 +6,29 @@ author: Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. - Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. - If it has changed since the last connection, the schema is downloaded and stored in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. - We found this a good anomaly use case to detect suspicious application like blackmatter ransomware that use ADS object api to execute ldap query. - having a good list of ldap or normal AD query tool used within the network is a good start to reduce the noise. -search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) - |stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name Computer - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic is to detect an application try to connect and create ADSI + Object to do LDAP query. Every time an application connects to the directory and + attempts to create an ADSI object, the Active Directory Schema is checked for changes. + If it has changed since the last connection, the schema is downloaded and stored + in a cache on the local computer either in %LOCALAPPDATA%\Microsoft\Windows\SchCache + or %systemroot%\SchCache. We found this a good anomaly use case to detect suspicious + application like blackmatter ransomware that use ADS object api to execute ldap + query. having a good list of ldap or normal AD query tool used within the network + is a good start to reduce the noise. +search: '`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename + = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time) + as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id process_name + Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schcache_change_by_app_connect_and_create_adsi_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. -known_false_positives: normal application like mmc.exe and other ldap query tool may trigger this detections. + Sysmon TA. +known_false_positives: normal application like mmc.exe and other ldap query tool may + trigger this detections. references: -- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac -- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ +- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac +- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/ tags: analytic_story: - blackMatter ransomware @@ -39,23 +44,23 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - TargetFilename - - EventCode - - process_id - - process_name - - Computer + - Image + - TargetFilename + - EventCode + - process_id + - process_name + - Computer security_domain: endpoint impact: 50 confidence: 50 - # (impact * confidence)/100 risk_score: 25 context: - - source:endpoint - - stage:Discovery + - source:endpoint + - stage:Discovery message: process $Image$ create a file $TargetFilename$ in host $Computer$ observable: - name: Computer type: Hostname role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 8d9d1c1580f277ee093131bfc0244c411cdd6c96 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 8 Sep 2021 12:57:27 -0700 Subject: [PATCH 15/21] Update system_information_discovery_detection.yml SPL logic update --- ...system_information_discovery_detection.yml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index ed90c3cbf4..2cbc3e5720 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -9,13 +9,18 @@ datamodel: description: Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" - OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user -Processes.process_name Processes.process Processes.dest Process.parent_process | `drop_dm_object_name(Processes)` - | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest - > 2 | stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime - by user, dest, parent_process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `system_information_discovery_detection_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" + OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user + Processes.process_name Processes.process Processes.dest Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| eventstats dc(process) as dc_processes_by_dest by dest +| where dc_processes_by_dest + > 2 +| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime + by user, dest parent_process_name +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `system_information_discovery_detection_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. From a1d200ab9912ccaec5dc9ec0c0dbc923f4188f30 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Sep 2021 20:23:23 +0000 Subject: [PATCH 16/21] Bump azure-core from 1.16.0 to 1.18.0 Bumps [azure-core](https://github.com/Azure/azure-sdk-for-python) from 1.16.0 to 1.18.0. - [Release notes](https://github.com/Azure/azure-sdk-for-python/releases) - [Commits](https://github.com/Azure/azure-sdk-for-python/compare/azure-core_1.16.0...azure-core_1.18.0) --- updated-dependencies: - dependency-name: azure-core dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 204eeb14aa..66b967a0b9 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -6,7 +6,7 @@ atomicwrites==1.4.0 attackcti==0.3.4.3 attrs==21.2.0 azure-common==1.1.27 -azure-core==1.16.0 +azure-core==1.18.0 azure-identity==1.6.0 azure-mgmt-compute==20.0.0 azure-mgmt-core==1.2.1 From b7be792a0600f43a4b25ead2593a831ddbbbb3d1 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 8 Sep 2021 23:28:03 +0000 Subject: [PATCH 17/21] Added detection testing service results inExtraction of Registry Hives --- detections/endpoint/extraction_of_registry_hives.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index bd88ccc998..7cadfcbe50 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi a untrusted process or script. Upon execution, a file will be written to disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe - (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam * - OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest + (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam + * OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' From e1434e2f291b0cfb641d072baa59716520f1816c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 8 Sep 2021 16:54:09 -0700 Subject: [PATCH 18/21] adding labels --- .github/workflows/auto-merge.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 96c30258b6..4257c37a33 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -1,13 +1,17 @@ -name: auto-merge +name: automerge on: pull_request_target: jobs: - auto-merge: + automerge: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: ahmadnassri/action-dependabot-auto-merge@v2 - with: - target: minor - github-token: ${{ secrets.AUTOMERGE }} + + - name: Print the name of the actor + run: | + echo "The name of the actor is [${{ github.actor }}]" + - name: automerge + uses: "pascalgn/automerge-action@v0.14.3" + env: + GITHUB_TOKEN: "${{ secrets.AUTOMERGE }}" + MERGE_LABELS: "dependencies" From cb8309057498d66001b866d44e44efd7576b3c97 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 8 Sep 2021 17:12:56 -0700 Subject: [PATCH 19/21] Revert "adding labels" --- .github/workflows/auto-merge.yml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index 4257c37a33..96c30258b6 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -1,17 +1,13 @@ -name: automerge +name: auto-merge on: pull_request_target: jobs: - automerge: + auto-merge: runs-on: ubuntu-latest steps: - - - name: Print the name of the actor - run: | - echo "The name of the actor is [${{ github.actor }}]" - - name: automerge - uses: "pascalgn/automerge-action@v0.14.3" - env: - GITHUB_TOKEN: "${{ secrets.AUTOMERGE }}" - MERGE_LABELS: "dependencies" + - uses: actions/checkout@v2 + - uses: ahmadnassri/action-dependabot-auto-merge@v2 + with: + target: minor + github-token: ${{ secrets.AUTOMERGE }} From 6affec77b587a9ee13400c5adc2daaa2a3bff25a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 8 Sep 2021 17:41:57 -0700 Subject: [PATCH 20/21] SPL logic was wrong --- .../registry_keys_used_for_persistence.yml | 35 ++++++++++--------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d4981a39e1..bab2e67729 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -9,22 +9,25 @@ datamodel: description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* - OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Shell* - OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* - OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* - OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) - OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" Registry.registry_key_name=Debugger) - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" Registry.registry_key_name="Security Packages") - OR Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*" - OR (Registry.registry_path="*currentVersion\\Windows" Registry.registry_key_name="Load") - OR (Registry.registry_path="*\\CurrentVersion" Registry.registry_key_name="Svchost") - OR Registry.registry_path="*\\CurrentControlSet\Control\Session Manager" Registry.registry_key_name="BootExecute") - OR Registry.registry_path="*\\Software\\Run" Registry.registry_key_name="auto_update") - by Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter`' + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* + OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* + OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") + OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") + OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") + OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") + OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") + OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) + by Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` +| `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response From 37a2f54c26f2f83cccfd641e549ba5701943d25d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 9 Sep 2021 01:00:47 +0000 Subject: [PATCH 21/21] Added detection testing service results inRegistry Keys Used For Persistence --- .../registry_keys_used_for_persistence.yml | 36 +++++++++---------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index bab2e67729..0725a9de98 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -9,25 +9,23 @@ datamodel: description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* - OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* - OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* - OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* - OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* - OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") - OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") - OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") - OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") - OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") - OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) - by Registry.dest Registry.user -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` -| `registry_keys_used_for_persistence_filter`' + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* + OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* + OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* + OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* + OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows + NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) + OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security + Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" + AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows + NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" + AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" + AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session + Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" + AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response