admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-24 11:32:32 -08:00
committed by GitHub
parent 1bddc5433a 261b8e0bc2
commit a7a5704c25
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/registry_keys_used_for_persistence.yml
+3 -2
View File
@@ -2,14 +2,14 @@ name: Registry Keys Used For Persistence
id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
version: 7
date: '2022-01-26'
author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk
author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
type: TTP
datamodel:
- Endpoint
description: The search looks for modifications to registry keys that can be used
to launch an application or service at system startup.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
@@ -65,6 +65,7 @@ tags:
- Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log
- https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log
impact: 80
kill_chain_phases:
- Actions on Objectives