From c430efed7e741b041ef332e1771bc1316bd78b7e Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 16 Jun 2021 12:53:51 +0200
Subject: [PATCH] Delete allow_operation_with_consent_admin.yml

---
 .../allow_operation_with_consent_admin.yml    | 47 -------------------
 1 file changed, 47 deletions(-)
 delete mode 100644 detections/endpoint/allow_operation_with_consent_admin.yml

diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml
deleted file mode 100644
index 605e40bfd0..0000000000
--- a/detections/endpoint/allow_operation_with_consent_admin.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Allow Operation with Consent Admin
-id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 1
-date: '2021-06-10'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: this search is to detect a potential privilege escalation attempt to do malicious task.
-  This registry modification is designed to  allows the Consent Admin to perform an operation that 
-  requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation
-  to the compromise machine.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
-  FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name = "DWORD (0x00000000)"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `allow_operation_with_consent_admin_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
-- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
-tags:
-  analytic_story:
-  - Ransomware
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1548
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
\ No newline at end of file