From 431171ec241317b8a9d02abe44d1324ec2cf668c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 9 Sep 2021 11:47:24 -0600 Subject: [PATCH 1/2] Update extraction_of_registry_hives.yml Forgot quotes and added more slashes. Fixes for #1634 --- detections/endpoint/extraction_of_registry_hives.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index bd88ccc998..aad6761c2d 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -1,7 +1,7 @@ name: Extraction of Registry Hives id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 1 -date: '2021-05-12' +version: 2 +date: '2021-09-09' author: Michael Haag, Splunk type: TTP datamodel: @@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi a untrusted process or script. Upon execution, a file will be written to disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe - (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam * - OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest + (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *" + OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' From 314370ba56f6e916073f57d0cc144eda106bb2f3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 9 Sep 2021 18:23:05 +0000 Subject: [PATCH 2/2] Added detection testing service results inExtraction of Registry Hives --- detections/endpoint/extraction_of_registry_hives.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index aad6761c2d..02b3110392 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi a untrusted process or script. Upon execution, a file will be written to disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe - (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *" - OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest + (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam + *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'