From b2f18cc3d47622298024c7d16afccfd52bd52c8b Mon Sep 17 00:00:00 2001 From: root Date: Thu, 26 Nov 2020 11:34:53 +0000 Subject: [PATCH] Added detection testing service results inReg exe Manipulating Windows Services Registry Keys --- ...e_manipulating_windows_services_registry_keys.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index 08015a195f..14b5808c57 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -7,11 +7,12 @@ description: The search looks for reg.exe modifying registry keys that define Wi type: ESCU references: [] author: Rico Valdez, Splunk -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name - values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes - where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* - by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) + as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes + where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* + Processes.process=*Services* by Processes.process_id Processes.dest Processes.process + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter`' known_false_positives: It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. @@ -36,3 +37,4 @@ tags: - DE.CM security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed