admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inBCDEdit Failure Recovery Modification

Browse Source
This commit is contained in:
root
2021-01-11 23:08:28 +00:00
parent 723d3dac11
commit a2fa25f9bc
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/bcdedit_failure_recovery_modification.yml
+10 -5
View File
@@ -1,8 +1,10 @@
name: BCDEdit Failure Recovery Modification
id:
id: null
version: 1
date: '2020-12-21'
description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. Tune based on parent process names.
@@ -12,9 +14,11 @@ references:
author: Michael Haag, Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter`'
known_false_positives: Administrators may modify the boot configuration.
Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name
Processes.process Processes.parent_process_name Processes.dest Processes.user |
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `bcdedit_failure_recovery_modification_filter`'
known_false_positives: Administrators may modify the boot configuration.
tags:
analytics_story:
- Ryuk Ransomware
@@ -31,3 +35,4 @@ tags:
asset_type: Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
automated_detection_testing: passed