Added detection testing service results inMalicious InProcServer32 Modification

detections/endpoint/malicious_inprocserver32_modification.yml

@@ -1,40 +1,53 @@
 name: Malicious InProcServer32 Modification
-id: 127c8d08-25ff-11ec-9223-acde48001122 
+id: 127c8d08-25ff-11ec-9223-acde48001122
 version: 1
 date: '2021-10-05'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32.
-  Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID).  Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID.  The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops).
-  During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process.'
+description: The following analytic identifies a process modifying the registry with
+  a known malicious CLSID under InProcServer32. Most COM classes are registered with
+  the operating system and are identified by a GUID that represents the Class Identifier
+  (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID).  Behind
+  the implementation of a COM class is the server (some binary) that is referenced
+  within registry keys under the CLSID.  The LocalServer32 key represents a path to
+  an executable (exe) implementation, and the InprocServer32 key represents a path
+  to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel
+  processes for suspicious activity. Pivot on the process GUID to see the full timeline
+  of events. Analyze the value and look for file modifications. Being this is looking
+  for inprocserver32, a DLL found in the value will most likely be loaded by a parallel
+  process.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  by _time Processes.process_id Processes.process_name
-  Processes.dest Processes.process_guid Processes.user 
-  | `drop_dm_object_name(Processes)` 
-  | join process_guid 
-  [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest Registry.process_guid Registry.user 
-  | `drop_dm_object_name(Registry)` 
-  | fields _time dest registry_path registry_key_name
-  registry_value_name process_name process_path process process_guid user] 
-  | stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name
-  registry_value_name user 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `malicious_inprocserver32_modification_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.
+  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
+  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
+  `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path=
+  "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest
+  Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time
+  dest registry_path registry_key_name registry_value_name process_name process_path
+  process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime
+  by dest, process_name registry_path registry_key_name registry_value_name user |
+  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, filter as needed. In our
+  test case, Remcos used regsvr32.exe to modify the registry. It may be required,
+  dependent upon the EDR tool producing registry events, to remove (Default) from
+  the command-line.
 references:
-  - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/  
-  - https://tria.ge/210929-ap75vsddan
-  - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
   - Remcos
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -47,20 +60,20 @@ tags:
   required_fields:
   - _time
   - dest
-  - process_name 
-  - registry_path 
+  - process_name
+  - registry_path
   - registry_key_name
-  - registry_value_name 
-  - user  
+  - registry_value_name
+  - user
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32.
+  message: The $process_name$ was identified on endpoint $dest$ modifying the registry
+    with a known malicious clsid under InProcServer32.
   observable:
   - name: dest
     type: Hostname
@@ -69,4 +82,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  automated_detection_testing: passed