From d3d9e6a7c59b14c7bf42ec27431b2956fbb6c247 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 21 Dec 2022 11:56:42 -0800 Subject: [PATCH 1/2] update to SPL --- .../disable_defender_antivirus_registry.yml | 29 +++++++++---------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 1b87b6e3f7..c72584722f 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,8 +1,8 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 2 -date: '2022-01-26' -author: Teoderick Contreras, Splunk +version: 3 +date: '2022-12-21' +author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,19 +11,16 @@ description: This particular behavior is typically executed when an adversary or detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name - = DisableAntiVirus Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest - Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as - proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count - FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.parent_process_name Processes.parent_process - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | fields _time dest user parent_process_name parent_process process_name - process_path process proc_guid registry_path registry_value_name registry_value_data] - | table _time dest user parent_process_name parent_process process_name process_path - process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_antivirus_registry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)`] +| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +| where isnotnull(registry_value_data) +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From 5eca5da349b0a30c93cc2e48c1e8fd5e6c751340 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 9 Jan 2023 12:19:16 +0100 Subject: [PATCH 2/2] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index c72584722f..4eb003c6e2 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 3 date: '2022-12-21' -author: Steven Dick, Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk, Steven Dick type: TTP datamodel: - Endpoint