From 3f01dc7409fef27ad486633319f7160a5b46476f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 14 Oct 2021 14:24:25 -0700 Subject: [PATCH 1/8] Touched a number of detections to see if they fail with the current sysmon TA before testing against the sysmon TA update. --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- detections/endpoint/disable_amsi_through_registry.yml | 2 +- detections/endpoint/disable_etw_through_registry.yml | 2 +- detections/endpoint/disable_registry_tool.yml | 2 +- detections/endpoint/disable_show_hidden_files.yml | 2 +- detections/endpoint/disable_windows_behavior_monitoring.yml | 2 +- detections/endpoint/disabling_cmd_application.yml | 2 +- detections/endpoint/disabling_controlpanel.yml | 2 +- detections/endpoint/disabling_folderoptions_windows_feature.yml | 2 +- detections/endpoint/disabling_norun_windows_app.yml | 2 +- detections/endpoint/disabling_remote_user_account_control.yml | 2 +- detections/endpoint/disabling_systemrestore_in_registry.yml | 2 +- detections/endpoint/disabling_task_manager.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- detections/endpoint/windows_disableantispyware_reg.yml | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 4826d617e7..3a20b9dcd8 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -2,7 +2,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 1 date: '2021-06-10' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 893026ae11..06df178f57 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -2,7 +2,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 1 date: '2021-06-22' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 8e62da2998..6b5a3c0c54 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 1 date: '2021-06-22' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index b86174c023..04f2ef895a 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 8db415439d..b03a6e7f7e 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -2,7 +2,7 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Mauricio Velazco, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index bec73336b9..82ea03d25d 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 2e71a905be..4f599de204 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index c885277219..ceaedf4862 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -2,7 +2,7 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index c248d73630..08e758212a 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -2,7 +2,7 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index aa5c91dd54..91ba920d09 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -2,7 +2,7 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 7880312f6d..865202defa 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,7 +2,7 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 4 date: '2020-11-18' -author: David Dorsey, Patrick Bareiss, Splunk +author: David Dorsey, Patrick Bareiss, Splunk! type: TTP datamodel: [] description: The search looks for modifications to registry keys that control the diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 192f7c9f14..ca953b7a31 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index aa7fe700ee..593308047b 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -2,7 +2,7 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 1e09f29522..fe8e443440 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 1 date: '2021-05-05' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Splunk! type: TTP datamodel: - Endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 3388fb9e89..5c834e951d 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 2 date: '2021-03-02' -author: Rod Soto, Jose Hernandez, Michael Haag, Splunk +author: Rod Soto, Jose Hernandez, Michael Haag, Splunk! type: TTP datamodel: - Endpoint From 9f91279c514939d1cb0c88bd0048e44344d74cd3 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 14 Oct 2021 14:58:03 -0700 Subject: [PATCH 2/8] Changed affected Registry.registry_value_name fields to Registry.registry_value_data and changed value from DWORD(0x...) to 0x... This probably does not cover all the detections that will need to be addressed in this fix, but is a good initial pass to see if the fixes and new TA are working properly. --- .../endpoint/allow_operation_with_consent_admin.yml | 6 +++--- detections/endpoint/disable_amsi_through_registry.yml | 6 +++--- detections/endpoint/disable_etw_through_registry.yml | 6 +++--- detections/endpoint/disable_registry_tool.yml | 6 +++--- detections/endpoint/disable_show_hidden_files.yml | 8 ++++---- .../endpoint/disable_windows_behavior_monitoring.yml | 6 +++--- detections/endpoint/disabling_cmd_application.yml | 6 +++--- detections/endpoint/disabling_controlpanel.yml | 6 +++--- .../endpoint/disabling_folderoptions_windows_feature.yml | 6 +++--- detections/endpoint/disabling_norun_windows_app.yml | 6 +++--- .../endpoint/disabling_remote_user_account_control.yml | 6 +++--- .../endpoint/disabling_systemrestore_in_registry.yml | 6 +++--- detections/endpoint/disabling_task_manager.yml | 6 +++--- .../endpoint/hide_user_account_from_sign_in_screen.yml | 6 +++--- detections/endpoint/windows_disableantispyware_reg.yml | 6 +++--- 15 files changed, 46 insertions(+), 46 deletions(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 3a20b9dcd8..d15634d986 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -2,7 +2,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 1 date: '2021-06-10' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,8 +13,8 @@ description: This analytic identifies a potential privilege escalation attempt t machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name - = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_data + = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 06df178f57..1354ee640c 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -2,7 +2,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 1 date: '2021-06-22' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable AMSI payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 6b5a3c0c54..f85c202264 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 1 date: '2021-06-22' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable ETW payload with minimal alert as much as possible. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" - Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 04f2ef895a..fa2f80ae5f 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,8 +13,8 @@ description: This search identifies modification of registry to disable the rege and defense evasion. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index b03a6e7f7e..ed87f3bf3c 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -2,7 +2,7 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Mauricio Velazco, Splunk! +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint @@ -13,10 +13,10 @@ description: The following analytic is to identify a modification in the Windows search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" - Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= + Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" - Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000000") by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 82ea03d25d..fb8ec94ce1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -18,8 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Defender\\Real-Time Protection\\DisableRealtimeMonitoring" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIntrusionPreventionSystem" OR Registry.registry_path= "*\\Real-Time Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time - Protection\\DisableScriptScanning" Registry.registry_value_name = "DWORD (0x00000001)" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Protection\\DisableScriptScanning" Registry.registry_value_data = "0x00000001" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 4f599de204..9f650418a0 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,8 +12,8 @@ description: this search is to identify modification in registry to disable cmd to traverse on directory and files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index ceaedf4862..4fa8e046c6 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -2,7 +2,7 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -11,8 +11,8 @@ description: this search is to identify registry modification to disable control persistence removed on the infected machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 08e758212a..a518fad653 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -2,7 +2,7 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,8 +13,8 @@ description: This search is to identify registry modification to disable folder fake file extensions. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 91ba920d09..095ba16a7c 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -2,7 +2,7 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,8 +13,8 @@ description: This search is to identify modification of registry to disable run known application run easily through run shortcut. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 865202defa..9f50fb7552 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,15 +2,15 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 4 date: '2020-11-18' -author: David Dorsey, Patrick Bareiss, Splunk! +author: David Dorsey, Patrick Bareiss, Splunk type: TTP datamodel: [] description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* - Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name - Registry.user Registry.registry_path Registry.registry_value_name Registry.action + Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.action | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index ca953b7a31..44abfce90b 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -13,8 +13,8 @@ description: The following search identifies the modification of registry relate search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = - "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name + NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = + "0x00000001" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 593308047b..c7381aac98 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -2,7 +2,7 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 version: 1 date: '2021-03-31' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -12,8 +12,8 @@ description: This search is to identifies modification of registry to disable th their process. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" - Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + Registry.registry_value_data = "0x00000001" by Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index fe8e443440..7c4451c443 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 version: 1 date: '2021-05-05' -author: Teoderick Contreras, Splunk! +author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -14,8 +14,8 @@ description: This analytic identifies a suspicious registry modification to hide search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows - NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_name - = "DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_value_name + NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data + = "0x00000000" by Registry.dest Registry.user Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 5c834e951d..0a68b5b94e 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 2 date: '2021-03-02' -author: Rod Soto, Jose Hernandez, Michael Haag, Splunk! +author: Rod Soto, Jose Hernandez, Michael Haag, Splunk type: TTP datamodel: - Endpoint @@ -14,8 +14,8 @@ description: The search looks for the Registry Key DisableAntiSpyware set to dis processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" - AND Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user - Registry.registry_path Registry.registry_value_name | `drop_dm_object_name(Registry)` + AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user + Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 69b809579d43ce8b80fd1e870dd7de3c667fa6b6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 15 Oct 2021 14:58:21 -0700 Subject: [PATCH 3/8] Fixed filenames on some tests. There were named *.yml.test.yml instead of *.test.yml --- ...e.yml.test.yml => registry_keys_used_for_persistence.test.yml} | 0 ...t.yml.test.yml => schtasks_used_for_forcing_a_reboot.test.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{registry_keys_used_for_persistence.yml.test.yml => registry_keys_used_for_persistence.test.yml} (100%) rename tests/endpoint/{schtasks_used_for_forcing_a_reboot.yml.test.yml => schtasks_used_for_forcing_a_reboot.test.yml} (100%) diff --git a/tests/endpoint/registry_keys_used_for_persistence.yml.test.yml b/tests/endpoint/registry_keys_used_for_persistence.test.yml similarity index 100% rename from tests/endpoint/registry_keys_used_for_persistence.yml.test.yml rename to tests/endpoint/registry_keys_used_for_persistence.test.yml diff --git a/tests/endpoint/schtasks_used_for_forcing_a_reboot.yml.test.yml b/tests/endpoint/schtasks_used_for_forcing_a_reboot.test.yml similarity index 100% rename from tests/endpoint/schtasks_used_for_forcing_a_reboot.yml.test.yml rename to tests/endpoint/schtasks_used_for_forcing_a_reboot.test.yml From a6522d37b66ce3906e21c687eb4a3a6dc3b3a16c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 15 Oct 2021 15:31:54 -0700 Subject: [PATCH 4/8] Changed registry_key_name to registry_value_name in a number of detections in response to sysmonTA updates (correcting a previous error). --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- detections/endpoint/windows_disableantispyware_reg.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index d15634d986..f686eb598b 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -13,7 +13,7 @@ description: This analytic identifies a potential privilege escalation attempt t machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_data + Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 0a68b5b94e..c49225efd1 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -13,7 +13,7 @@ description: The search looks for the Registry Key DisableAntiSpyware set to dis registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" + as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`' From 2460d6b93b8b5d5e672a587fd73e50ed1daf4dee Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 15 Oct 2021 16:19:37 -0700 Subject: [PATCH 5/8] Fixing the naming of more Registry values --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 4 ++-- detections/endpoint/auto_admin_logon_registry_entry.yml | 4 ++-- detections/endpoint/disable_windows_app_hotkeys.yml | 2 +- detections/endpoint/enable_rdp_in_other_port_number.yml | 2 +- .../registry_keys_used_for_privilege_escalation.yml | 6 +++--- detections/endpoint/sdclt_uac_bypass.yml | 2 +- ...owershell_execution_policy_to_unrestricted_or_bypass.yml | 2 +- 7 files changed, 11 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 9e3a41015f..d892bd0fa5 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -14,8 +14,8 @@ description: this search is to detect a suspicious registry modification to impl premise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name= DefaultPassword OR - Registry.registry_key_name= DefaultUserName by Registry.registry_path Registry.registry_key_name + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR + Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 57027ab701..a163863cd5 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -14,8 +14,8 @@ description: this search is to detect a suspicious registry modification to impl premise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND - Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND + Registry.registry_value_name=1 by Registry.registry_path Registry.registry_value_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 6fee3152df..c410456ccf 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name - = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest + = "HotKey Disabled" AND Registry.registry_value_name = "Debugger" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you must be ingesting data diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index e17acbf201..9eb016f2fd 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -13,7 +13,7 @@ description: This search is to detect a modification to registry to enable rdp t search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal - Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e91f558ec6..58e08e5f56 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -11,9 +11,9 @@ description: This search looks for modifications to registry keys that can be us to benign system binaries. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows - NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag - OR Registry.registry_key_name=Debugger) by Registry.dest Registry.user Registry.registry_path - Registry.registry_key_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag + OR Registry.registry_value_name=Debugger) by Registry.dest Registry.user Registry.registry_path + Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index 45477c7d1c..2345394d1d 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -13,7 +13,7 @@ description: This search is to detect a suspicious sdclt.exe registry modificati search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") - (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") + (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`' diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 4a007740e3..3233fd7147 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -10,7 +10,7 @@ description: Monitor for changes of the ExecutionPolicy in the registry to the v "unrestricted" or "bypass," which allows the execution of malicious scripts. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* - Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted + Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' From 46fb3965062f7ac3214e66d744542b53526ae6d1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Oct 2021 13:55:49 -0700 Subject: [PATCH 6/8] Changed one registry related detection to fix field name. --- detections/endpoint/wsreset_uac_bypass.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index 5d2ab46587..381dfcf38c 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -12,7 +12,7 @@ description: This search is to detect a suspicious modification of registry rela account Control. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" - (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute") + (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`' From cebe2118e56224f6f68e8ca64e02469e1ee251af Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 18 Oct 2021 16:45:34 -0700 Subject: [PATCH 7/8] Fixed name of one of the test files. --- ...=> get_aduserresultantpasswordpolicy_with_powershell.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{get_aduserresultantpasswordpolicy_with_powershell_.test.yml => get_aduserresultantpasswordpolicy_with_powershell.test.yml} (100%) diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell.test.yml similarity index 100% rename from tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml rename to tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell.test.yml From 3a8dc379bda2e41109b64f9672215af809f00809 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 1 Dec 2021 14:36:49 -0800 Subject: [PATCH 8/8] Restoring modified files because they do not work with the new sysmon. Now, all of the detections in this branch work. --- detections/endpoint/auto_admin_logon_registry_entry.yml | 5 +++-- detections/endpoint/disable_windows_app_hotkeys.yml | 3 ++- ...powershell_execution_policy_to_unrestricted_or_bypass.yml | 3 ++- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index a163863cd5..0ce8b228ee 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -14,8 +14,8 @@ description: this search is to detect a suspicious registry modification to impl premise. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND - Registry.registry_value_name=1 by Registry.registry_path Registry.registry_value_name + NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND + Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -42,6 +42,7 @@ tags: to prepare autoadminlogon mitre_attack_id: - T1552.002 + - T1552 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index c410456ccf..9f5f3fcfa4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_name - = "HotKey Disabled" AND Registry.registry_value_name = "Debugger" by Registry.dest + = "HotKey Disabled" AND Registry.registry_key_name = "Debugger" by Registry.dest Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you must be ingesting data @@ -43,6 +43,7 @@ tags: message: Disabled 'Windows App Hotkeys' on $dest$ mitre_attack_id: - T1562.001 + - T1562 observable: - name: dest type: Endpoint diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 3233fd7147..61f741ddab 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -10,7 +10,7 @@ description: Monitor for changes of the ExecutionPolicy in the registry to the v "unrestricted" or "bypass," which allows the execution of malicious scripts. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* - Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted + Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' @@ -46,6 +46,7 @@ tags: message: A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ mitre_attack_id: + - T1059 - T1059.001 nist: - DE.CM