diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 45b22bb7bd..af8147d405 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -14,8 +14,8 @@ description: this search is to detect a suspicious registry modification to impl premise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR - Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR + Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 4826d617e7..f686eb598b 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -13,8 +13,8 @@ description: This analytic identifies a potential privilege escalation attempt t machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name - = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data + = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index b3234563e7..5e7f43c564 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable AMSI payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 15fc3b41a4..a240517b10 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable ETW payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" - Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index c4a9d34f67..753e21afd4 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -13,8 +13,8 @@ description: This search identifies modification of registry to disable the rege and defense evasion. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 7fc1e7e9ce..e5f42b4a97 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -13,10 +13,10 @@ description: The following analytic is to identify a modification in the Windows search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" - Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= + Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" - Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 70d9ef034a..8f0bbde971 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -18,8 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time - Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index da42de93a5..0b7882c7ac 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable cmd to traverse on directory and files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index af3b83aa32..f49aa6872d 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -11,8 +11,8 @@ description: this search is to identify registry modification to disable control persistence removed on the infected machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index b7c827178f..09632c7e1a 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -13,8 +13,8 @@ description: This search is to identify registry modification to disable folder fake file extensions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index e64e16287e..eb8a126002 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -13,8 +13,8 @@ description: This search is to identify modification of registry to disable run known application run easily through run shortcut. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 18d6e60eed..d0ea85b197 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -9,8 +9,8 @@ description: The search looks for modifications to registry keys that control th enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* - Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_name Registry.action + Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 1447e5c71e..61756ac311 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -13,8 +13,8 @@ description: The following search identifies the modification of registry relate search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = - "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = + "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 7e09a87f91..cd03580645 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -12,8 +12,8 @@ description: This search is to identifies modification of registry to disable th their process. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index e17acbf201..9eb016f2fd 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -13,7 +13,7 @@ description: This search is to detect a modification to registry to enable rdp t search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal - Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index a25bd2c490..5077b8937f 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -14,8 +14,8 @@ description: This analytic identifies a suspicious registry modification to hide search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows - NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name - = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name + NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data + = "0x00000000" by Registry.dest Registry.user Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 111952d065..22362f7da6 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -11,9 +11,9 @@ description: This search looks for modifications to registry keys that can be us to benign system binaries. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows - NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag - OR Registry.registry_key_name=Debugger) by Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag + OR Registry.registry_value_name=Debugger) by Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index db3b46956c..b1294133da 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -13,7 +13,7 @@ description: This search is to detect a suspicious sdclt.exe registry modificati search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") - (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") + (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`' diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index bb539c4ea0..21c653d774 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -13,9 +13,9 @@ description: The search looks for the Registry Key DisableAntiSpyware set to dis registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" - AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)` + as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" + AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user + Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 6b4a5762ea..e696178005 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -12,7 +12,7 @@ description: This search is to detect a suspicious modification of registry rela account Control. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" - (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute") + (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`' diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell.test.yml similarity index 100% rename from tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml rename to tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell.test.yml diff --git a/tests/endpoint/registry_keys_used_for_persistence.yml.test.yml b/tests/endpoint/registry_keys_used_for_persistence.test.yml similarity index 100% rename from tests/endpoint/registry_keys_used_for_persistence.yml.test.yml rename to tests/endpoint/registry_keys_used_for_persistence.test.yml diff --git a/tests/endpoint/schtasks_used_for_forcing_a_reboot.yml.test.yml b/tests/endpoint/schtasks_used_for_forcing_a_reboot.test.yml similarity index 100% rename from tests/endpoint/schtasks_used_for_forcing_a_reboot.yml.test.yml rename to tests/endpoint/schtasks_used_for_forcing_a_reboot.test.yml