admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-05-15 12:16:19 -07:00
committed by GitHub
parent b04d091888 7643758830
commit b09e5b7c6c
55 changed files with 298 additions and 1095 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.vscode/security-content.code-snippets
Vendored
+18
View File
@@ -327,6 +327,24 @@
"`process_netsh`"
],
"description": "netsh macro"
},
"date version": {
"prefix": "date version",
"body": [
"version: 4",
"date: '2023-04-27'",
],
"description": "date version"
},
"time": {
"prefix": "time",
"body": [
"| `security_content_ctime(firstTime)`",
"| `security_content_ctime(lastTime)`",
],
"description": "time"
}
}
detections/endpoint/active_setup_registry_autostart.yml
+6 -23
View File
@@ -1,7 +1,7 @@
name: Active Setup Registry Autostart
id: f64579c0-203f-11ec-abcc-acde48001122
version: 3
date: '2023-04-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -14,18 +14,10 @@ description: This analytic is to detect a suspicious modification of the active
valid setup installer that creating or modifying this registry.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active
Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -62,15 +54,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+7 -24
View File
@@ -1,7 +1,7 @@
name: Add DefaultUser And Password In Registry
id: d4a3eb62-0f1e-11ec-a971-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-03-29'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -13,19 +13,11 @@ description: this search is to detect a suspicious registry modification to impl
premise.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name=
DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `add_defaultuser_and_password_in_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -55,15 +47,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+7 -24
View File
@@ -1,7 +1,7 @@
name: Allow Inbound Traffic By Firewall Rule Registry
id: 0a46537c-be02-11eb-92ca-acde48001122
version: 4
date: '2022-11-14'
version: 5
date: '2023-03-29'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,19 +11,11 @@ description: This analytic detects a potential suspicious modification of firewa
by allowing the traffic in a firewall rule.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
"*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `allow_inbound_traffic_by_firewall_rule_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -60,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/allow_operation_with_consent_admin.yml
+7 -24
View File
@@ -1,7 +1,7 @@
name: Allow Operation with Consent Admin
id: 7de17d7a-c9d8-11eb-a812-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-03-29'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,19 +12,11 @@ description: This analytic identifies a potential privilege escalation attempt t
machine.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
= "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `allow_operation_with_consent_admin_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -60,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/auto_admin_logon_registry_entry.yml
+8 -24
View File
@@ -1,7 +1,7 @@
name: Auto Admin Logon Registry Entry
id: 1379d2b8-0f18-11ec-8ca3-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-11'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -13,19 +13,12 @@ description: this search is to detect a suspicious registry modification to impl
premise.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1)
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `auto_admin_logon_registry_entry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `auto_admin_logon_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -56,15 +49,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_amsi_through_registry.yml
+9 -24
View File
@@ -1,28 +1,22 @@
name: Disable AMSI Through Registry
id: 9c27ec42-d338-11eb-9044-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-11'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: this search is to identify modification in registry to disable AMSI windows
feature to evade detections. This technique was seen in several ransomware, RAT
and even APT to impaire defenses of the compromise machine and to be able to execute
payload with minimal alert as much as possible.
payload with minimal alert as much as possible.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable"
Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_amsi_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -54,15 +48,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_defender_antivirus_registry.yml
+8 -24
View File
@@ -1,7 +1,7 @@
name: Disable Defender AntiVirus Registry
id: aa4f695a-3024-11ec-9987-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-11'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,19 +12,12 @@ description: This particular behavior is typically executed when an adversary or
any further file modifications. Endpoint should be isolated.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name
IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001)
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_defender_antivirus_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_antivirus_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -58,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+12 -27
View File
@@ -1,28 +1,22 @@
name: Disable Defender BlockAtFirstSeen Feature
id: 2dd719ac-3021-11ec-97b4-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-11'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
description: This analytic is intended to detect a suspicious modification of the
Windows registry to disable a Windows Defender feature. This technique is intended
to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen
feature where it blocks suspicious files the first time seen on the host.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h
Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_blockatfirstseen_feature_filter`'
description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
a Windows Defender feature. This technique is intended to bypass or evade detection from
Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks
suspicious files the first time seen on the host.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_blockatfirstseen_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_defender_mpengine_registry.yml
+8 -24
View File
@@ -1,7 +1,7 @@
name: Disable Defender MpEngine Registry
id: cc391750-3024-11ec-955a-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-11'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,19 +12,12 @@ description: This particular behavior is typically executed when an adversary or
any further file modifications. Endpoint should be isolated.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*"
Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000)
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_defender_mpengine_registry_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `disable_defender_mpengine_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical
@@ -58,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_defender_spynet_reporting.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Defender Spynet Reporting
id: 898debf4-3021-11ec-ba7c-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of re
Defender telemetry.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= SpynetReporting Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -58,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Defender Submit Samples Consent Feature
id: 73922ff8-3022-11ec-bf5e-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of th
that submits samples for further analysis.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
= SubmitSamplesConsent Registry.registry_value_data = 0x00000000) BY _time span=1h
Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_etw_through_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable ETW Through Registry
id: f0eacfa4-d33f-11eb-8f9d-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable ETW
payload with minimal alert as much as possible.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -53,15 +47,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_registry_tool.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Registry Tool
id: cd2cf33c-9201-11eb-a10a-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,11 @@ description: This search identifies modification of registry to disable the rege
and defense evasion.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -53,15 +47,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_security_logs_using_minint_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,16 +11,10 @@ description: This analytic is to detect a suspicious registry modification to di
will not log any event to the Security Log
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -54,15 +48,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_show_hidden_files.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Show Hidden Files
id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,19 +11,13 @@ description: The following analytic is to identify a modification in the Windows
on the infected machine.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
Registry.registry_value_data = "0x00000000")) BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_uac_remote_restriction.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable UAC Remote Restriction
id: 9928b732-210e-11ec-b65e-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious modification of registry to
gain privilege escalation.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy"
Registry.registry_value_data="0x00000001" ) BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -58,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_windows_app_hotkeys.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Windows App Hotkeys
id: 1490f224-ad8b-11eb-8c4f-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunkk
status: production
type: TTP
@@ -12,18 +12,12 @@ description: This analytic detects a suspicious registry modification to disable
implant in compromised systems.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution
Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name
= "Debugger") BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -54,15 +48,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_windows_behavior_monitoring.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disable Windows Behavior Monitoring
id: 79439cae-9200-11eb-a4d3-acde48001122
version: 3
date: '2023-04-25'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -10,11 +10,7 @@ description: This search is to identifies a modification in registry to disable
seen in RAT, bot, or Trojan to disable AV to evade detections.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path=
@@ -25,9 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime
Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning"
AND Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -62,15 +56,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disable_windows_smartscreen_protection.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Disable Windows SmartScreen Protection
id: 664f0fd0-91ff-11eb-a56f-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,10 @@ description: The following search identifies a modification of registry to disab
downloading other of its component or other payload.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data=
"Off") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +50,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_cmd_application.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling CMD Application
id: ff86077c-9212-11eb-a1e6-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable cmd
to traverse on directory and files.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +50,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_controlpanel.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling ControlPanel
id: 6ae0148e-9215-11eb-a94a-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -10,17 +10,11 @@ description: this search is to identify registry modification to disable control
persistence removed on the infected machine.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -55,15 +49,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_defender_services.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling Defender Services
id: 911eacdc-317f-11ec-ad30-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,19 +12,13 @@ description: This particular behavior is typically executed when an adversaries
any further file modifications. Endpoint should be isolated.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND
(Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*",
"*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data
= 0x00000004) BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -60,15 +54,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_folderoptions_windows_feature.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling FolderOptions Windows Feature
id: 83776de4-921a-11eb-868a-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,11 @@ description: This search is to identify registry modification to disable folder
fake file extensions.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_norun_windows_app.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling NoRun Windows App
id: de81bc46-9213-11eb-adc9-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,11 @@ description: This search is to identify modification of registry to disable run
known application run easily through run shortcut.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -59,15 +53,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_systemrestore_in_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling SystemRestore In Registry
id: f4f837e2-91fb-11eb-8bf6-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,20 +11,14 @@ description: The following search identifies the modification of registry relate
their infection on the box.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR"
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR"
OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -59,15 +53,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/disabling_task_manager.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Disabling Task Manager
id: dac279bc-9202-11eb-b7fb-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,17 +11,11 @@ description: This search is to identifies modification of registry to disable th
their process.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +50,6 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/enable_rdp_in_other_port_number.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Enable RDP In Other Port Number
id: 99495452-b899-11eb-96dc-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,18 +11,11 @@ description: This search is to detect a modification to registry to enable rdp t
control of it.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY _time
span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +49,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+6 -22
View File
@@ -1,7 +1,7 @@
name: Enable WDigest UseLogonCredential Registry
id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,18 +12,11 @@ description: This analytic is to detect a suspicious registry modification to en
crendential of the host so it must be a good pivot for credential dumping techniques.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data
= 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -59,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
@@ -79,6 +63,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
detections/endpoint/etw_registry_disabled.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: ETW Registry Disabled
id: 8ed523ac-276b-11ec-ac39-acde48001122
version: 3
date: '2023-04-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -10,17 +10,11 @@ description: This analytic is to detect a registry modification to disable ETW f
its execution from audit logs.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name
= ETWEnabled Registry.registry_value_data=0x00000000) BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -59,15 +53,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/hide_user_account_from_sign_in_screen.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Hide User Account From Sign-In Screen
id: 834ba832-ad89-11eb-937d-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,11 @@ description: This analytic identifies a suspicious registry modification to hide
on that said machine.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*"
AND Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -64,15 +58,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml
+6 -21
View File
@@ -1,7 +1,7 @@
name: Linux Account Manipulation Of SSH Config and Keys
id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2
version: 1
date: '2022-04-12'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -18,15 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted AND
Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name
Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action |
`drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid |join proc_guid,
_time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.parent_process_name != unknown by _time span=1h Processes.process_id
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process
process_name process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action] | table process_name process proc_guid file_name file_path
action _time parent_process_name parent_process process_path dest user | `linux_account_manipulation_of_ssh_config_and_keys_filter`'
`drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_account_manipulation_of_ssh_config_and_keys_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -63,15 +57,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
tests:
@@ -79,4 +64,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
sourcetype: sysmon_linux
detections/endpoint/linux_deletion_of_cron_jobs.yml
+6 -23
View File
@@ -1,7 +1,7 @@
name: Linux Deletion Of Cron Jobs
id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -16,18 +16,10 @@ description: This analytic is to detect a deletion of cron job in a linux machin
data_source:
- Sysmon Event ID 11
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path
="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename
process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid
| `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name action]
| table process_name process proc_guid file_name file_path action _time parent_process_name
parent_process process_path dest user | `linux_deletion_of_cron_jobs_filter`'
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -65,15 +57,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
tests:
detections/endpoint/linux_deletion_of_init_daemon_script.yml
+5 -21
View File
@@ -1,7 +1,7 @@
name: Linux Deletion Of Init Daemon Script
id: 729aab57-d26f-4156-b97f-ab8dda8f44b1
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -20,15 +20,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path
IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path
Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)`
|rename process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid
| `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name action]
| table process_name process proc_guid file_name file_path action _time parent_process_name
parent_process process_path dest user | `linux_deletion_of_init_daemon_script_filter`'
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_deletion_of_init_daemon_script_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -66,15 +59,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
tests:
@@ -82,4 +66,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
sourcetype: sysmon_linux
detections/endpoint/linux_deletion_of_services.yml
+6 -22
View File
@@ -1,7 +1,7 @@
name: Linux Deletion Of Services
id: b509bbd3-0331-4aaa-8e4a-d2affe100af6
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -18,16 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path
IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path
= "*.service" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename
process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid
| `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time
dest user parent_process_name parent_process process_name process_path process proc_guid
registry_path registry_value_name registry_value_data registry_key_name action]
| table process_name process proc_guid file_name file_path action _time parent_process_name
parent_process process_path dest user | `linux_deletion_of_services_filter`'
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_deletion_of_services_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -68,15 +61,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
tests:
@@ -84,4 +68,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
sourcetype: sysmon_linux
detections/endpoint/linux_deletion_of_ssl_certificate.yml
+6 -21
View File
@@ -1,7 +1,7 @@
name: Linux Deletion of SSL Certificate
id: 839ab790-a60a-4f81-bfb3-02567063f615
version: 1
date: '2022-04-12'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -19,15 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path
= "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by _time span=1h
Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid
Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid
|join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.parent_process_name != unknown by _time span=1h Processes.process_id
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process
process_name process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action] | table process_name process proc_guid file_name file_path
action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_ssl_certificate_filter`'
Filesystem.action | `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_deletion_of_ssl_certificate_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -64,15 +58,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
tests:
@@ -80,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
sourcetype: sysmon_linux
detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml
+7 -24
View File
@@ -1,7 +1,7 @@
name: Linux High Frequency Of File Deletion In Boot Folder
id: e27fbc5d-0445-4c4a-bc39-87f060d5c602
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name)
deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path)
as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.action=deleted Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename
process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*",
"/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process
process_name process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action] | table process_name process proc_guid action _time deletedFileNames
deletedFilePath numOfDelFilePath parent_process_name parent_process process_path
dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`'
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_high_frequency_of_file_deletion_in_boot_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -66,15 +58,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
tests:
@@ -82,4 +65,4 @@ tests:
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
sourcetype: sysmon_linux
detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
+6 -23
View File
@@ -1,7 +1,7 @@
name: Linux High Frequency Of File Deletion In Etc Folder
id: 9d867448-2aff-4d07-876c-89409a752ff8
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name)
deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path)
as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
where Filesystem.action=deleted Filesystem.file_path = "/etc/*" by _time span=1h Filesystem.dest
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename
process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown
NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*",
"/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id
Processes.process_name Processes.process Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`
|rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process
process_name process_path process proc_guid registry_path registry_value_name registry_value_data
registry_key_name action] | table process_name process proc_guid action _time deletedFileNames
deletedFilePath numOfDelFilePath parent_process_name parent_process process_path
dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`'
Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_high_frequency_of_file_deletion_in_etc_folder_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
@@ -65,15 +57,6 @@ tags:
- Filesystem.process_guid
- Filesystem.file_path
- Filesystem.action
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_name
- Processes.process_path
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
tests:
detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Monitor Registry Keys for Print Monitors
id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
version: 4
date: '2022-11-14'
version: 5
date: '2023-04-27'
author: Steven Dick, Bhavin Patel, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,10 @@ description: This search looks for registry activity associated with modificatio
with elevated (SYSTEM) permissions and will persist after reboot.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*")
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -54,15 +47,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/registry_keys_for_creating_shim_databases.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Registry Keys for Creating SHIM Databases
id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
version: 5
date: '2022-11-14'
version: 6
date: '2023-04-27'
author: Steven Dick, Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -9,17 +9,10 @@ description: This search looks for registry activity associated with application
shims, which can be leveraged by attackers for various nefarious purposes.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*)
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +49,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Registry Keys Used For Privilege Escalation
id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
version: 6
date: '2023-04-14'
version: 7
date: '2023-04-27'
author: Steven Dick, David Dorsey, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -11,18 +11,11 @@ description: This search looks for modifications to registry keys that can be us
to benign system binaries.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File
Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger))
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -63,15 +56,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/time_provider_persistence_registry.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Time Provider Persistence Registry
id: 5ba382c4-2105-11ec-8d8f-acde48001122
version: 3
date: '2023-04-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -12,17 +12,10 @@ description: This analytic is to detect a suspicious modification of time provid
modified by normal user or even an admin.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*")
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -61,15 +54,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_defender_exclusion_registry_entry.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Windows Defender Exclusion Registry Entry
id: 13395a44-4dd9-11ec-9df7-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -13,17 +13,10 @@ description: This analytic will detect a suspicious process that modify a regist
defense evasion and to look further for events after this behavior.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*")
BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -61,15 +54,6 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_change_password_through_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Disable Change Password Through Registry
id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -16,17 +16,11 @@ description: This analytic is to detect a suspicious registry modification to di
is needed to minimized false positive.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -58,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Disable Lock Workstation Feature Through Registry
id: c82adbc6-9f00-11ec-a81f-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious registry modification to di
to the compromised host.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation"
Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -54,15 +48,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_logoff_button_through_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Disable LogOff Button Through Registry
id: b2fb6830-9ed1-11ec-9fcb-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -16,18 +16,12 @@ description: This analytic is to detect a suspicious registry modification to di
filter of machine and users that can modify this registry is needed.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data
= "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -61,15 +55,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_memory_crash_dump.yml
+11 -23
View File
@@ -1,7 +1,7 @@
name: Windows Disable Memory Crash Dump
id: 59e54602-9680-11ec-a8a6-acde48001122
version: 1
date: '2023-04-14'
version: 2
date: '2023-04-27'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -18,14 +18,9 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)`
|join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
Processes.parent_process_name Processes.parent_process Processes.process_guid |
`drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process
process_name process_path process process_guid registry_path registry_value_name
registry_value_data registry_key_name] | table _time dest user parent_process_name
parent_process process_name process_path process process_guid registry_path registry_value_name
registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`'
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_memory_crash_dump_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the Filesystem responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry`
@@ -70,19 +65,12 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Filesystem.file_create_time
- Filesystem.process_id
- Filesystem.file_name
- Filesystem.user
- Filesystem.file_path
- Filesystem.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
- Registry.process_guid
risk_score: 90
security_domain: endpoint
tests:
detections/endpoint/windows_disable_notification_center.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Disable Notification Center
id: 1cd983c8-8fd6-11ec-a09d-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -12,17 +12,11 @@ description: The following search identifies a modification of registry to disab
downloading other of its component or other payload.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data
= "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -55,15 +49,6 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_shutdown_button_through_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -14,18 +14,12 @@ description: This analytic is to detect a suspicious registry modification to di
users that can modify this registry is needed.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path
Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
+4 -17
View File
@@ -1,7 +1,7 @@
name: Windows Disable Windows Group Policy Features Through Registry
id: 63a449ae-9f04-11ec-945e-acde48001122
version: 3
date: '2022-11-14'
version: 4
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -14,12 +14,8 @@ description: This analytic is to detect a suspicious registry modification to di
allowed doing this is needed.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`
| where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -56,15 +52,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_hide_notification_features_through_registry.yml
+4 -20
View File
@@ -1,7 +1,7 @@
name: Windows Hide Notification Features Through Registry
id: cafa4bce-9f06-11ec-a7b2-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -13,19 +13,12 @@ description: This analytic is to detect a suspicious registry modification to hi
In this scenario filter is needed.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork",
"HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY
_time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`]
| fields firstTime lastTime dest user parent_process_name parent_process process_name
process_path process registry_key_name registry_path registry_value_name registry_value_data
process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)`
Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +49,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Modify Show Compress Color And Info Tip Registry
id: b7548c2e-9a10-11ec-99e3-acde48001122
version: 2
date: '2023-04-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -14,17 +14,11 @@ description: This analytic is to look for suspicious registry modification relat
NTFS file system.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h
Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime
dest user parent_process_name parent_process process_name process_path process registry_key_name
registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -56,15 +50,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name
detections/endpoint/windows_registry_certificate_added.yml
+7 -13
View File
@@ -1,10 +1,10 @@
name: Windows Registry Certificate Added
id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87
version: 1
date: '2022-03-31'
version: 2
date: '2023-04-27'
author: Michael Haag, Splunk
status: production
type: TTP
type: Anomaly
description: The following analytic identifies installation of a root CA certificate
by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml).
In short, there are specific certificate registry paths that will be written to
@@ -20,11 +20,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`]
| table _time dest user process_name process process_guid registry_path registry_value_name
registry_value_data registry_key_name | `windows_registry_certificate_added_filter`'
`drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_registry_certificate_added_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
@@ -62,11 +61,6 @@ tags:
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.process_guid
risk_score: 42
security_domain: endpoint
tests:
detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml
+6 -12
View File
@@ -1,7 +1,7 @@
name: Windows Registry Modification for Safe Mode Persistence
id: c6149154-c9d8-11eb-9da7-acde48001122
version: 3
date: '2022-03-31'
version: 4
date: '2023-04-27'
author: Teoderick Contreras, Michael Haag, Splunk
status: production
type: TTP
@@ -17,11 +17,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*")
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
Registry.process_guid Registry.registry_key_name Registry.registry_value_data |
`drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`]
| table _time dest user process_name process process_guid registry_path registry_value_name
registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`'
`drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_registry_modification_for_safe_mode_persistence_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
@@ -63,11 +62,6 @@ tags:
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.dest
- Processes.process_guid
risk_score: 42
security_domain: endpoint
tests:
detections/endpoint/windows_service_creation_using_registry_entry.yml
+4 -19
View File
@@ -1,7 +1,7 @@
name: Windows Service Creation Using Registry Entry
id: 25212358-948e-11ec-ad47-acde48001122
version: 2
date: '2022-11-14'
version: 3
date: '2023-04-27'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: TTP
@@ -13,17 +13,11 @@ description: This analytic is to look for suspicious modification or creation of
to create a service entry using registry ImagePath.
data_source:
- Sysmon Event ID 1
search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time)
AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id
Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name
Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`
| join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name
= ImagePath) BY _time span=1h Registry.registry_path Registry.registry_key_name
Registry.registry_value_name Registry.registry_value_data Registry.process_guid
| `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name
parent_process process_name process_path process registry_key_name registry_path
registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data)
| `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data)
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the registry value name, registry path, and registry value data from your
@@ -57,15 +51,6 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.user
- Processes.dest
- Processes.process_id
- Processes.process_name
- Processes.process
- Processes.process_path
- Processes.parent_process_name
- Processes.parent_process
- Processes.process_guid
- Registry.dest
- Registry.registry_value_name
- Registry.registry_key_name