From cb2777672c9d10f768b47cee7255a123e95bfca6 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 07:07:20 -0600
Subject: [PATCH 1/2] Renaming Detection

Resolving #1634
---
 ...m_from_registry.yml => extraction_of_registry_hives.yml} | 6 +++---
 ...istry.test.yml => extraction_of_registry_hives.test.yml} | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename detections/endpoint/{extract_sam_from_registry.yml => extraction_of_registry_hives.yml} (96%)
 rename tests/endpoint/{extract_sam_from_registry.test.yml => extraction_of_registry_hives.test.yml} (75%)

diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extraction_of_registry_hives.yml
similarity index 96%
rename from detections/endpoint/extract_sam_from_registry.yml
rename to detections/endpoint/extraction_of_registry_hives.yml
index fcce95ace9..bd88ccc998 100644
--- a/detections/endpoint/extract_sam_from_registry.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -1,4 +1,4 @@
-name: Extract SAM from Registry
+name: Extraction of Registry Hives
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
 version: 1
 date: '2021-05-12'
@@ -12,11 +12,11 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam*
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam *
   OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
diff --git a/tests/endpoint/extract_sam_from_registry.test.yml b/tests/endpoint/extraction_of_registry_hives.test.yml
similarity index 75%
rename from tests/endpoint/extract_sam_from_registry.test.yml
rename to tests/endpoint/extraction_of_registry_hives.test.yml
index 3115761dc0..10e6370649 100644
--- a/tests/endpoint/extract_sam_from_registry.test.yml
+++ b/tests/endpoint/extraction_of_registry_hives.test.yml
@@ -1,7 +1,7 @@
-name: Extract SAM from Registry Unit Test
+name: Extraction of Registry Hives Unit Test
 tests:
-- name: Extract SAM from Registry
-  file: endpoint/extract_sam_from_registry.yml
+- name: Extraction of Registry Hives
+  file: endpoint/extraction_of_registry_hives.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From b7be792a0600f43a4b25ead2593a831ddbbbb3d1 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-188-185>
Date: Wed, 8 Sep 2021 23:28:03 +0000
Subject: [PATCH 2/2] Added detection testing service results inExtraction of
 Registry Hives

---
 detections/endpoint/extraction_of_registry_hives.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index bd88ccc998..7cadfcbe50 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam *
-  OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam
+  * OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'