Branch was auto-updated.

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -14,8 +14,8 @@ description: this search is to detect a suspicious registry modification to impl
   premise.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
-  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR
-  Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
+  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR
+  Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
   Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -13,8 +13,8 @@ description: This analytic identifies a potential privilege escalation attempt t
   machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
-  Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name
-  = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
+  = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data

detections/endpoint/disable_amsi_through_registry.yml

@@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable AMSI
   payload with minimal alert as much as possible.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
-  Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000"
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/disable_etw_through_registry.yml

@@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable ETW
   payload with minimal alert as much as possible.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
-  Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disable_registry_tool.yml

@@ -13,8 +13,8 @@ description: This search identifies modification of registry to disable the rege
   and defense evasion.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disable_show_hidden_files.yml

@@ -13,10 +13,10 @@ description: The following analytic is to identify a modification in the Windows
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
   OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
-  Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path=
+  Registry.registry_value_data = "0x00000001") OR (Registry.registry_path=
   "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
-  Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disable_windows_behavior_monitoring.yml

@@ -18,8 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path=
   "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path=
   "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time
-  Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001"
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_data
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/disabling_cmd_application.yml

@@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable cmd
   to traverse on directory and files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disabling_controlpanel.yml

@@ -11,8 +11,8 @@ description: this search is to identify registry modification to disable control
   persistence removed on the infected machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disabling_folderoptions_windows_feature.yml

@@ -13,8 +13,8 @@ description: This search is to identify registry modification to disable folder
   fake file extensions.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disabling_norun_windows_app.yml

@@ -13,8 +13,8 @@ description: This search is to identify modification of registry to disable run
   known application run easily through run shortcut.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/disabling_remote_user_account_control.yml

@@ -9,8 +9,8 @@ description: The search looks for modifications to registry keys that control th
   enforcement of Windows User Account Control (UAC).
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*
-  Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name
-  Registry.user Registry.registry_path Registry.registry_value_name Registry.action
+  Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name
+  Registry.user Registry.registry_path Registry.registry_value_data Registry.action
   | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/disabling_systemrestore_in_registry.yml

@@ -13,8 +13,8 @@ description: The following search identifies the modification of registry relate
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
   NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
-  NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name =
-  "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data =
+  "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information

detections/endpoint/disabling_task_manager.yml

@@ -12,8 +12,8 @@ description: This search is to identifies modification of registry to disable th
   their process.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -13,7 +13,7 @@ description: This search is to detect a modification to registry to enable rdp t
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
-  Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest
+  Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by Registry.dest
   Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting

detections/endpoint/hide_user_account_from_sign_in_screen.yml

@@ -14,8 +14,8 @@ description: This analytic identifies a suspicious registry modification to hide
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
-  NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name
-  = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name
+  NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data
+  = "0x00000000" by Registry.dest Registry.user Registry.registry_value_data
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
   | `hide_user_account_from_sign_in_screen_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -11,9 +11,9 @@ description: This search looks for modifications to registry keys that can be us
   to benign system binaries.
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows
-  NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag
-  OR Registry.registry_key_name=Debugger) by Registry.dest  Registry.user Registry.registry_path
-  Registry.registry_key_name | `security_content_ctime(lastTime)`  | `security_content_ctime(firstTime)`
+  NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag
+  OR Registry.registry_value_name=Debugger) by Registry.dest  Registry.user Registry.registry_path
+  Registry.registry_value_name | `security_content_ctime(lastTime)`  | `security_content_ctime(firstTime)`
   | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/sdclt_uac_bypass.yml

@@ -13,7 +13,7 @@ description: This search is to detect a suspicious sdclt.exe registry modificati
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App
   Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*")
-  (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand")
+  (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand")
   by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'

detections/endpoint/windows_disableantispyware_reg.yml

@@ -13,9 +13,9 @@ description: The search looks for the Registry Key DisableAntiSpyware set to dis
   registry and scheduled task modifications will occur. During triage, review parallel
   processes and identify any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware"
-  AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user
-  Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)`
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware"
+  AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user
+  Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from

detections/endpoint/wsreset_uac_bypass.yml

@@ -12,7 +12,7 @@ description: This search is to detect a suspicious modification of registry rela
   account Control.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*"
-  (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute")
+  (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute")
   by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
   Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`'