From cb46cac717a94e06969d672f7ea5adaa59a4949c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 29 Mar 2023 13:22:24 -0600 Subject: [PATCH 1/8] First batch testing --- .../endpoint/active_setup_registry_autostart.yml | 12 ++++-------- .../add_defaultuser_and_password_in_registry.yml | 13 ++++--------- ...ow_inbound_traffic_by_firewall_rule_registry.yml | 13 ++++--------- .../endpoint/allow_operation_with_consent_admin.yml | 13 ++++--------- 4 files changed, 16 insertions(+), 35 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 65fda96aaf..1ac4a0a6ac 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -13,13 +13,9 @@ description: This analytic is to detect a suspicious modification of the active do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ +search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid - | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index afa65e912a..13ba0a90dc 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -12,13 +12,8 @@ description: this search is to detect a suspicious registry modification to impl continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid - | where isnotnull(registry_value_data) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 189ed65da8..cd4ea00447 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 4 -date: '2022-11-14' +version: 5 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -10,13 +10,8 @@ description: This analytic detects a potential suspicious modification of firewa rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid - | where isnotnull(registry_value_data) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|LPort=*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 5f1507cc18..df190a1356 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-03-29' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,13 +11,8 @@ description: This analytic identifies a potential privilege escalation attempt t Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid - | where isnotnull(registry_value_data) +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' From 2f5cfd1556e952a8768384a056662e8aa38194d6 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Apr 2023 10:07:10 -0600 Subject: [PATCH 2/8] Update auto_admin_logon_registry_entry.yml --- .../endpoint/auto_admin_logon_registry_entry.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index edf78d6a80..5598bd215b 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -1,7 +1,7 @@ name: Auto Admin Logon Registry Entry id: 1379d2b8-0f18-11ec-8ca3-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -12,12 +12,8 @@ description: this search is to detect a suspicious registry modification to impl continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 363799e85b235ce43a79ef943c1192945f0cb668 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Apr 2023 10:59:15 -0600 Subject: [PATCH 3/8] Update disable_amsi_through_registry.yml --- .../endpoint/disable_amsi_through_registry.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 8afb172c22..d9c3bba352 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,7 +1,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,12 +10,8 @@ description: this search is to identify modification in registry to disable AMSI feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From c55307a0e5ad340810dcc39b4c1682c6650f1bdd Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Apr 2023 11:01:31 -0600 Subject: [PATCH 4/8] 3 --- .../endpoint/disable_defender_antivirus_registry.yml | 12 ++++-------- .../disable_defender_blockatfirstseen_feature.yml | 12 ++++-------- .../endpoint/disable_defender_mpengine_registry.yml | 12 ++++-------- 3 files changed, 12 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 2a58664723..aa13507e81 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,12 +11,8 @@ description: This particular behavior is typically executed when an adversary or detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name IN ("DisableAntiSpyware","DisableAntiVirus") Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index f78c4be85c..59bb1351df 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,12 +10,8 @@ description: This analytic is intended to detect a suspicious modification of th a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 0660f01a82..cf2fb88d19 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-11' author: Steven Dick, Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,12 +11,8 @@ description: This particular behavior is typically executed when an adversary or detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From aba28cfbc3f885c2081ba18a5e20123c0e74fb63 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 11 Apr 2023 11:28:37 -0600 Subject: [PATCH 5/8] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 1ac4a0a6ac..ad04f8374f 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -13,8 +13,7 @@ description: This analytic is to detect a suspicious modification of the active do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. -search: ' - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `active_setup_registry_autostart_filter`' From eb1bc08eeb55416fb6285146539e1bc6b0cfe388 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 27 Apr 2023 22:01:49 -0600 Subject: [PATCH 6/8] We're going to need a bigger Docker --- .vscode/security-content.code-snippets | 18 ++++++++++++ .../disable_defender_spynet_reporting.yml | 14 +++------ ...efender_submit_samples_consent_feature.yml | 14 +++------ .../endpoint/disable_etw_through_registry.yml | 14 +++------ detections/endpoint/disable_registry_tool.yml | 14 +++------ ...le_security_logs_using_minint_registry.yml | 14 +++------ .../endpoint/disable_show_hidden_files.yml | 14 +++------ .../disable_uac_remote_restriction.yml | 14 +++------ .../endpoint/disable_windows_app_hotkeys.yml | 14 +++------ .../disable_windows_behavior_monitoring.yml | 14 +++------ ...disable_windows_smartscreen_protection.yml | 15 +++------- .../endpoint/disabling_cmd_application.yml | 14 +++------ .../endpoint/disabling_controlpanel.yml | 14 +++------ .../endpoint/disabling_defender_services.yml | 14 +++------ ...isabling_folderoptions_windows_feature.yml | 14 +++------ .../endpoint/disabling_norun_windows_app.yml | 14 +++------ .../disabling_systemrestore_in_registry.yml | 14 +++------ .../endpoint/disabling_task_manager.yml | 14 +++------ .../enable_rdp_in_other_port_number.yml | 15 +++------- ...le_wdigest_uselogoncredential_registry.yml | 14 +++------ detections/endpoint/etw_registry_disabled.yml | 14 +++------ .../hide_user_account_from_sign_in_screen.yml | 14 +++------ ...nt_manipulation_of_ssh_config_and_keys.yml | 27 ++++------------- .../endpoint/linux_deletion_of_cron_jobs.yml | 29 ++++--------------- .../linux_deletion_of_init_daemon_script.yml | 17 ++++------- .../endpoint/linux_deletion_of_services.yml | 19 ++++-------- .../linux_deletion_of_ssl_certificate.yml | 18 ++++-------- ...quency_of_file_deletion_in_boot_folder.yml | 22 +++++--------- ...equency_of_file_deletion_in_etc_folder.yml | 20 ++++--------- ...nitor_registry_keys_for_print_monitors.yml | 24 +++------------ ...istry_keys_for_creating_shim_databases.yml | 15 +++------- ...try_keys_used_for_privilege_escalation.yml | 15 +++------- .../time_provider_persistence_registry.yml | 15 +++------- ...dows_defender_exclusion_registry_entry.yml | 15 +++------- ...sable_change_password_through_registry.yml | 14 +++------ ...k_workstation_feature_through_registry.yml | 14 +++------ ...disable_logoff_button_through_registry.yml | 14 +++------ .../windows_disable_memory_crash_dump.yml | 15 ++++------ .../windows_disable_notification_center.yml | 14 +++------ ...sable_shutdown_button_through_registry.yml | 14 +++------ ...group_policy_features_through_registry.yml | 12 +++----- ...notification_features_through_registry.yml | 15 +++------- ...w_compress_color_and_info_tip_registry.yml | 14 +++------ .../windows_registry_certificate_added.yml | 15 +++++----- ...modification_for_safe_mode_persistence.yml | 13 ++++----- ..._service_creation_using_registry_entry.yml | 14 +++------ 46 files changed, 218 insertions(+), 500 deletions(-) diff --git a/.vscode/security-content.code-snippets b/.vscode/security-content.code-snippets index 2541633abf..456d9e148c 100644 --- a/.vscode/security-content.code-snippets +++ b/.vscode/security-content.code-snippets @@ -327,6 +327,24 @@ "`process_netsh`" ], "description": "netsh macro" + }, + + "date version": { + "prefix": "date version", + "body": [ + "version: 4", + "date: '2023-04-27'", + ], + "description": "date version" + }, + + "time": { + "prefix": "time", + "body": [ + "| `security_content_ctime(firstTime)`", + "| `security_content_ctime(lastTime)`", + ], + "description": "time" } } \ No newline at end of file diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 6b6e7d0c39..3c7e7b7662 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,7 +1,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of re Defender telemetry. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_spynet_reporting_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index c2306d01f3..82a0ffaaee 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This analytic is intended to detect a suspicious modification of th that submits samples for further analysis. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_defender_submit_samples_consent_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 945cf9ac80..31c5882d7c 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -1,7 +1,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable ETW payload with minimal alert as much as possible. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled" Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_etw_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 15d35b9ef1..3f17e73242 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -1,7 +1,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search identifies modification of registry to disable the rege and defense evasion. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_registry_tool_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index d360153028..dd7ea905bb 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -1,7 +1,7 @@ name: Disable Security Logs Using MiniNt Registry id: 39ebdc68-25b9-11ec-aec7-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,16 +11,10 @@ description: This analytic is to detect a suspicious registry modification to di will not log any event to the Security Log data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Control\\MiniNt\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_security_logs_using_minint_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 20694e7832..4958a86578 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -1,7 +1,7 @@ name: Disable Show Hidden Files id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,19 +11,13 @@ description: The following analytic is to identify a modification in the Windows on the infected machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_data = "0x00000001") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_data = "0x00000000")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 4a38463c43..0cd2b1ef69 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -1,7 +1,7 @@ name: Disable UAC Remote Restriction id: 9928b732-210e-11ec-b65e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious modification of registry to gain privilege escalation. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001" ) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 79b7426bd4..dc3758e643 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -1,7 +1,7 @@ name: Disable Windows App Hotkeys id: 1490f224-ad8b-11eb-8c4f-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunkk status: production type: TTP @@ -12,18 +12,12 @@ description: This analytic detects a suspicious registry modification to disable implant in compromised systems. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name = "Debugger") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_app_hotkeys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 260c0fd8dc..635f58dc1e 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -1,7 +1,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,11 +10,7 @@ description: This search is to identifies a modification in registry to disable seen in RAT, bot, or Trojan to disable AV to evade detections. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= @@ -25,9 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime Protection\\DisableIOAVProtection" OR Registry.registry_path= "*\\Real-Time Protection\\DisableScriptScanning" AND Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 97e50644e2..45286bb99d 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -1,7 +1,7 @@ name: Disable Windows SmartScreen Protection id: 664f0fd0-91ff-11eb-a56f-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: The following search identifies a modification of registry to disab downloading other of its component or other payload. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_data= "Off") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 57fc6ee1c6..fe0edb9ff5 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -1,7 +1,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: this search is to identify modification in registry to disable cmd to traverse on directory and files. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_cmd_application_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 02bee212a7..8d807427ee 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -1,7 +1,7 @@ name: Disabling ControlPanel id: 6ae0148e-9215-11eb-a94a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,17 +10,11 @@ description: this search is to identify registry modification to disable control persistence removed on the infected machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index ea81a3a6df..cd449f0205 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -1,7 +1,7 @@ name: Disabling Defender Services id: 911eacdc-317f-11ec-ad30-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,19 +12,13 @@ description: This particular behavior is typically executed when an adversaries any further file modifications. Endpoint should be isolated. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*")) AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_defender_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 4e08ec2fe1..fa0a4d52c5 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -1,7 +1,7 @@ name: Disabling FolderOptions Windows Feature id: 83776de4-921a-11eb-868a-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search is to identify registry modification to disable folder fake file extensions. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 1e72bfffdc..1c0a4475c5 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -1,7 +1,7 @@ name: Disabling NoRun Windows App id: de81bc46-9213-11eb-adc9-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This search is to identify modification of registry to disable run known application run easily through run shortcut. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index bb61fdacac..ea771d8c76 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -1,7 +1,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,20 +11,14 @@ description: The following search identifies the modification of registry relate their infection on the box. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index dece1f22e2..4e7a1f5357 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -1,7 +1,7 @@ name: Disabling Task Manager id: dac279bc-9202-11eb-b7fb-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,17 +11,11 @@ description: This search is to identifies modification of registry to disable th their process. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 2886fe41d1..67781d5c85 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -1,7 +1,7 @@ name: Enable RDP In Other Port Number id: 99495452-b899-11eb-96dc-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -11,18 +11,11 @@ description: This search is to detect a modification to registry to enable rdp t control of it. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 8d2949d41b..91f5f271a3 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -1,7 +1,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,18 +12,12 @@ description: This analytic is to detect a suspicious registry modification to en crendential of the host so it must be a good pivot for credential dumping techniques. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index d92b8e3ed4..86cfcf42f1 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,7 +1,7 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -10,17 +10,11 @@ description: This analytic is to detect a registry modification to disable ETW f its execution from audit logs. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*" Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `etw_registry_disabled_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 98cb306ffa..1d4bfd1210 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -1,7 +1,7 @@ name: Hide User Account From Sign-In Screen id: 834ba832-ad89-11eb-937d-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,11 @@ description: This analytic identifies a suspicious registry modification to hide on that said machine. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data = "0x00000000") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hide_user_account_from_sign_in_screen_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml index 5caeb160b8..f2f343371f 100644 --- a/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml +++ b/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml @@ -1,7 +1,7 @@ name: Linux Account Manipulation Of SSH Config and Keys id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,15 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | - `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid |join proc_guid, - _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.parent_process_name != unknown by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid file_name file_path - action _time parent_process_name parent_process process_path dest user | `linux_account_manipulation_of_ssh_config_and_keys_filter`' + `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_account_manipulation_of_ssh_config_and_keys_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -63,15 +57,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: @@ -79,4 +64,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 935df9abf7..be80715368 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Cron Jobs id: 3b132a71-9335-4f33-9932-00bb4f6ac7e8 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,10 @@ description: This analytic is to detect a deletion of cron job in a linux machin data_source: - Sysmon Event ID 11 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path - ="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_cron_jobs_filter`' + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path="/etc/cron.*" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_cron_jobs_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -64,15 +56,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index b4a66fcda9..40159c3900 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Init Daemon Script id: 729aab57-d26f-4156-b97f-ab8dda8f44b1 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -20,15 +20,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/init.d/*") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` - |rename process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_init_daemon_script_filter`' + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_init_daemon_script_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -81,4 +74,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 9cbf3637d8..fea259908d 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -1,7 +1,7 @@ name: Linux Deletion Of Services id: b509bbd3-0331-4aaa-8e4a-d2affe100af6 -version: 1 -date: '2023-02-15' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -18,16 +18,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path IN ( "/etc/systemd/*", "*/lib/systemd/*", "*/run/systemd/*") Filesystem.file_path = "*.service" by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid - | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time - dest user parent_process_name parent_process process_name process_path process proc_guid - registry_path registry_value_name registry_value_data registry_key_name action] - | table process_name process proc_guid file_name file_path action _time parent_process_name - parent_process process_path dest user | `linux_deletion_of_services_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -83,4 +76,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 3454454c7c..32648096b1 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -1,7 +1,7 @@ name: Linux Deletion of SSL Certificate id: 839ab790-a60a-4f81-bfb3-02567063f615 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -19,15 +19,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/ssl/certs/*" Filesystem.file_path IN ("*.pem", "*.crt") by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid - Filesystem.action | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid - |join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.parent_process_name != unknown by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid file_name file_path - action _time parent_process_name parent_process process_path dest user | `linux_deletion_of_ssl_certificate_filter`' + Filesystem.action | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_deletion_of_ssl_certificate_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -80,4 +74,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/acidrain/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index dc5acb2fe0..82a1a16256 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -1,7 +1,7 @@ name: Linux High Frequency Of File Deletion In Boot Folder id: e27fbc5d-0445-4c4a-bc39-87f060d5c602 -version: 1 -date: '2022-04-22' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/boot/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", - "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid action _time deletedFileNames - deletedFilePath numOfDelFilePath parent_process_name parent_process process_path - dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_high_frequency_of_file_deletion_in_boot_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from @@ -82,4 +74,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux + sourcetype: sysmon_linux \ No newline at end of file diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index f10fa5366b..0e3d33c18b 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -1,7 +1,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder id: 9d867448-2aff-4d07-876c-89409a752ff8 -version: 1 -date: '2022-04-12' +version: 2 +date: '2023-04-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,10 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) deletedFileNames values(Filesystem.file_path) as deletedFilePath dc(Filesystem.file_path) as numOfDelFilePath count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.action=deleted Filesystem.file_path = "/etc/*" by _time span=1h Filesystem.dest - Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` |rename - process_guid as proc_guid |join proc_guid, _time [ | tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.parent_process_name != unknown - NOT (Processes.parent_process_name IN ("/usr/bin/dpkg", "*usr/bin/python*", "*/usr/bin/apt-*", - "/bin/rm", "*splunkd", "/usr/bin/mandb")) by _time span=1h Processes.process_id - Processes.process_name Processes.process Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)` - |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process - process_name process_path process proc_guid registry_path registry_value_name registry_value_data - registry_key_name action] | table process_name process proc_guid action _time deletedFileNames - deletedFilePath numOfDelFilePath parent_process_name parent_process process_path - dest user | where numOfDelFilePath >= 200 | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' + Filesystem.process_guid Filesystem.action | `drop_dm_object_name(Filesystem)` | where numOfDelFilePath >= 200 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_high_frequency_of_file_deletion_in_etc_folder_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 23eb5d4cb0..9be7147ba6 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,7 +1,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 4 -date: '2022-11-14' +version: 5 +date: '2023-04-27' author: Steven Dick, Bhavin Patel, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: This search looks for registry activity associated with modificatio with elevated (SYSTEM) permissions and will persist after reboot. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your @@ -54,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 8ee8d7912b..eeb6ef8529 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,7 +1,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 5 -date: '2022-11-14' +version: 6 +date: '2023-04-27' author: Steven Dick, Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk status: production type: TTP @@ -9,17 +9,10 @@ description: This search looks for registry activity associated with application shims, which can be leveraged by attackers for various nefarious purposes. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 9e67722f0b..951fbd1197 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 6 -date: '2022-11-14' +version: 7 +date: '2023-04-27' author: Steven Dick, David Dorsey, Teoderick Contreras, Splunk status: production type: TTP @@ -11,18 +11,11 @@ description: This search looks for modifications to registry keys that can be us to benign system binaries. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index d1f7ae0a7d..c4245673e3 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,7 +1,7 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -12,17 +12,10 @@ description: This analytic is to detect a suspicious modification of time provid modified by normal user or even an admin. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 0f3ab8ab88..5201921f81 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Defender Exclusion Registry Entry id: 13395a44-4dd9-11ec-9df7-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -13,17 +13,10 @@ description: This analytic will detect a suspicious process that modify a regist defense evasion and to look further for events after this behavior. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\*") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_exclusion_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 148d05c67d..7caad8d44a 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,17 +16,11 @@ description: This analytic is to detect a suspicious registry modification to di is needed to minimized false positive. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_change_password_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 3366c63fd5..a6fee1ce73 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,17 +12,11 @@ description: This analytic is to detect a suspicious registry modification to di to the compromised host. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_lock_workstation_feature_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index b62060951d..8923fb9552 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,18 +16,12 @@ description: This analytic is to detect a suspicious registry modification to di filter of machine and users that can modify this registry is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_logoff_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index e230023818..297e5f4a87 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,7 +1,7 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 1 -date: '2022-02-25' +version: 2 +date: '2023-04-27' author: Michael Haag, Splunk status: production type: TTP @@ -18,14 +18,9 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name | `drop_dm_object_name(Registry)` - |join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.parent_process_name Processes.parent_process Processes.process_guid | - `drop_dm_object_name(Processes)` | fields _time dest user parent_process_name parent_process - process_name process_path process process_guid registry_path registry_value_name - registry_value_data registry_key_name] | table _time dest user parent_process_name - parent_process process_name process_path process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`' + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_memory_crash_dump_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index efb43bfe2b..f06556419d 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -1,7 +1,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,17 +12,11 @@ description: The following search identifies a modification of registry to disab downloading other of its component or other payload. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_notification_center_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 002f8f2938..4780c74261 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,18 +14,12 @@ description: This analytic is to detect a suspicious registry modification to di users that can modify this registry is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 26333b81fc..a090c8e1b2 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 3 -date: '2022-11-14' +version: 4 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,12 +14,8 @@ description: This analytic is to detect a suspicious registry modification to di allowed doing this is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid - | `drop_dm_object_name(Processes)` - | join process_guid [ - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name process_path process registry_key_name registry_path registry_value_name registry_value_data process_guid +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index 7d016b3240..b8da7dce4f 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -1,7 +1,7 @@ name: Windows Hide Notification Features Through Registry id: cafa4bce-9f06-11ec-a7b2-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,19 +13,12 @@ description: This analytic is to detect a suspicious registry modification to hi In this scenario filter is needed. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`] - | fields firstTime lastTime dest user parent_process_name parent_process process_name - process_path process registry_key_name registry_path registry_value_name registry_value_data - process_guid | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` + Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hide_notification_features_through_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 9eeed3b765..897e015fa2 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -1,7 +1,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -14,17 +14,11 @@ description: This analytic is to look for suspicious registry modification relat NTFS file system. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip")) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data - Registry.process_guid | `drop_dm_object_name(Registry)`] | fields firstTime lastTime - dest user parent_process_name parent_process process_name process_path process registry_key_name - registry_path registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_show_compress_color_and_info_tip_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index 304464a7ae..a793646233 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -1,10 +1,10 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 -version: 1 -date: '2022-03-31' +version: 2 +date: '2023-04-27' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly description: The following analytic identifies installation of a root CA certificate by monitoring the registry. The base paths may be found [here](https://gist.github.com/mattifestation/75d6117707bcf8c26845b3cbb6ad2b6b/raw/ae65ef15c706140ffc2e165615204e20f2903028/RootCAInstallationDetection.xml). In short, there are specific certificate registry paths that will be written to @@ -20,11 +20,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] - | table _time dest user process_name process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_registry_certificate_added_filter`' + `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_certificate_added_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index 8a2b7a0067..41717caeaf 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -1,7 +1,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 3 -date: '2022-03-31' +version: 4 +date: '2023-04-27' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,11 +17,10 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | - `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name - Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] - | table _time dest user process_name process process_guid registry_path registry_value_name - registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`' + `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_modification_for_safe_mode_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 4d53e97e82..bdeb32186d 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 2 -date: '2022-11-14' +version: 3 +date: '2023-04-27' author: Steven Dick, Teoderick Contreras, Splunk status: production type: TTP @@ -13,17 +13,11 @@ description: This analytic is to look for suspicious modification or creation of to create a service entry using registry ImagePath. data_source: - Sysmon Event ID 1 -search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) - AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id - Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name - Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` - | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid - | `drop_dm_object_name(Registry)`] | fields firstTime lastTime dest user parent_process_name - parent_process process_name process_path process registry_key_name registry_path - registry_value_name registry_value_data process_guid | where isnotnull(registry_value_data) + | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your From 7f2f92bde488f2d062f972b07d46908823632149 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 27 Apr 2023 22:42:50 -0600 Subject: [PATCH 7/8] Update enable_wdigest_uselogoncredential_registry.yml --- .../enable_wdigest_uselogoncredential_registry.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 91f5f271a3..2ba3867c2a 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -12,10 +12,9 @@ description: This analytic is to detect a suspicious registry modification to en crendential of the host so it must be a good pivot for credential dumping techniques. data_source: - Sysmon Event ID 1 -search: ' | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*" - Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data - = 0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name + Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data=0x00000001) BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enable_wdigest_uselogoncredential_registry_filter`' @@ -73,6 +72,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 95828c9d721b88413463a4a27e84b3a0f900a910 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 4 May 2023 10:49:10 -0600 Subject: [PATCH 8/8] fixed required fields --- .../active_setup_registry_autostart.yml | 9 --------- ...d_defaultuser_and_password_in_registry.yml | 9 --------- ...ound_traffic_by_firewall_rule_registry.yml | 9 --------- .../allow_operation_with_consent_admin.yml | 9 --------- .../auto_admin_logon_registry_entry.yml | 9 --------- .../disable_amsi_through_registry.yml | 9 --------- .../disable_defender_antivirus_registry.yml | 9 --------- ...able_defender_blockatfirstseen_feature.yml | 9 --------- .../disable_defender_mpengine_registry.yml | 9 --------- .../disable_defender_spynet_reporting.yml | 9 --------- ...efender_submit_samples_consent_feature.yml | 9 --------- .../endpoint/disable_etw_through_registry.yml | 9 --------- detections/endpoint/disable_registry_tool.yml | 9 --------- ...le_security_logs_using_minint_registry.yml | 9 --------- .../endpoint/disable_show_hidden_files.yml | 9 --------- .../disable_uac_remote_restriction.yml | 9 --------- .../endpoint/disable_windows_app_hotkeys.yml | 9 --------- ...disable_windows_smartscreen_protection.yml | 9 --------- .../endpoint/disabling_cmd_application.yml | 9 --------- .../endpoint/disabling_controlpanel.yml | 9 --------- .../endpoint/disabling_defender_services.yml | 9 --------- ...isabling_folderoptions_windows_feature.yml | 9 --------- .../endpoint/disabling_norun_windows_app.yml | 9 --------- .../disabling_systemrestore_in_registry.yml | 9 --------- .../endpoint/disabling_task_manager.yml | 9 --------- .../enable_rdp_in_other_port_number.yml | 9 --------- ...le_wdigest_uselogoncredential_registry.yml | 9 --------- detections/endpoint/etw_registry_disabled.yml | 9 --------- .../hide_user_account_from_sign_in_screen.yml | 9 --------- .../linux_deletion_of_init_daemon_script.yml | 9 --------- .../endpoint/linux_deletion_of_services.yml | 9 --------- .../linux_deletion_of_ssl_certificate.yml | 9 --------- ...quency_of_file_deletion_in_boot_folder.yml | 9 --------- ...equency_of_file_deletion_in_etc_folder.yml | 9 --------- ...istry_keys_for_creating_shim_databases.yml | 9 --------- ...try_keys_used_for_privilege_escalation.yml | 9 --------- .../time_provider_persistence_registry.yml | 9 --------- ...dows_defender_exclusion_registry_entry.yml | 9 --------- ...sable_change_password_through_registry.yml | 9 --------- ...k_workstation_feature_through_registry.yml | 9 --------- ...disable_logoff_button_through_registry.yml | 9 --------- .../windows_disable_memory_crash_dump.yml | 19 ++++++------------- .../windows_disable_notification_center.yml | 9 --------- ...sable_shutdown_button_through_registry.yml | 9 --------- ...group_policy_features_through_registry.yml | 9 --------- ...notification_features_through_registry.yml | 9 --------- ...w_compress_color_and_info_tip_registry.yml | 9 --------- .../windows_registry_certificate_added.yml | 5 ----- ...modification_for_safe_mode_persistence.yml | 5 ----- ..._service_creation_using_registry_entry.yml | 9 --------- 50 files changed, 6 insertions(+), 446 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index ef23155a99..35f2c90f73 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -54,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 836c008b31..d6f5b44704 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -47,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 782adef185..b814456469 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index d65277297d..525c674c38 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index ecbe7f32ab..f2b3be250e 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -49,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index c05746124e..c1a1e0e001 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -48,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 91867fb663..261fd5cd6b 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 12abe1ad91..11fa687a58 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 8b78d77704..7e74e914c8 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 3c7e7b7662..da76151b74 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 82a0ffaaee..f054852b01 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 31c5882d7c..3303cee687 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -47,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 3f17e73242..a2999d35ef 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -47,15 +47,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index dd7ea905bb..e083f54d2a 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -48,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 4958a86578..c8b289b0eb 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 0cd2b1ef69..d728d2f541 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index dc3758e643..b1df2a632d 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -48,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 45286bb99d..0b78c8fe18 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -50,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index fe0edb9ff5..ec95a0ef58 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -50,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 8d807427ee..f4cc6bd865 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -49,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 8aa3fafaff..a0b497f6f6 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -54,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index fa0a4d52c5..f01f61d0c3 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 1c0a4475c5..4d3e5e7bf6 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -53,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index ea771d8c76..c09ba33994 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -53,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 4e7a1f5357..81ceda93eb 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -50,15 +50,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 67781d5c85..aabfe80855 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -49,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 2ba3867c2a..4e3ebec80d 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index d8ed48d64f..f7e1e25e30 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -53,15 +53,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 1d4bfd1210..20019c2fcd 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -58,15 +58,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 6bb8810ebc..52b9b4bbaf 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -59,15 +59,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index 97dc032638..e5254716b4 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -61,15 +61,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index 32648096b1..e1b58f85e6 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -58,15 +58,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml index 8f2656af63..7e520ee8e6 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml @@ -58,15 +58,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 80 security_domain: endpoint tests: diff --git a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml index 237bda872e..59eb6fc4dd 100644 --- a/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml +++ b/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml @@ -57,15 +57,6 @@ tags: - Filesystem.process_guid - Filesystem.file_path - Filesystem.action - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_path - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint tests: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index eeb6ef8529..365a042cf3 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -49,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 141d63f2ef..b93685b9fe 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -56,15 +56,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index d26eb70616..853c30860a 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -54,15 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index 5201921f81..e32b32de0d 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -54,15 +54,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 7caad8d44a..9392c85e6e 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index a6fee1ce73..5c936dac83 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -48,15 +48,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 8923fb9552..b0c94e2d27 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -55,15 +55,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index acfd16527e..7c72079b38 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -65,19 +65,12 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - - Filesystem.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid + - Registry.dest + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.registry_path + - Registry.registry_value_data + - Registry.process_guid risk_score: 90 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index f06556419d..003d3255e9 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -49,15 +49,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index 4780c74261..925d61e96c 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index a090c8e1b2..9f258469fd 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -52,15 +52,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml index b8da7dce4f..8366ad24f9 100644 --- a/detections/endpoint/windows_hide_notification_features_through_registry.yml +++ b/detections/endpoint/windows_hide_notification_features_through_registry.yml @@ -49,15 +49,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index b4e1883221..feca71daa4 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -50,15 +50,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index a793646233..6706a0612b 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -61,11 +61,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.process_guid risk_score: 42 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index 41717caeaf..e6c979fe54 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -62,11 +62,6 @@ tags: - Registry.registry_key_name - Registry.registry_value_name - Registry.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.process_guid risk_score: 42 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index bdeb32186d..4305460aa6 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -51,15 +51,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.process_path - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid - Registry.dest - Registry.registry_value_name - Registry.registry_key_name