From c50404646b1178482e061b203b0d02208cdf1663 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 23 Nov 2020 11:37:22 +0100 Subject: [PATCH] new test file --- ...owershell_process_with_obfuscation_techniques.yml | 2 +- .../monitor_registry_keys_for_print_monitors.yml | 12 +++++++----- ...monitor_registry_keys_for_print_monitors.test.yml | 10 ++++++++++ 3 files changed, 18 insertions(+), 6 deletions(-) rename detections/{endpoint => deprecated}/malicious_powershell_process_with_obfuscation_techniques.yml (94%) create mode 100644 tests/endpoint/monitor_registry_keys_for_print_monitors.test.yml diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/deprecated/malicious_powershell_process_with_obfuscation_techniques.yml similarity index 94% rename from detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml rename to detections/deprecated/malicious_powershell_process_with_obfuscation_techniques.yml index a259ed9609..334c8f08bb 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/deprecated/malicious_powershell_process_with_obfuscation_techniques.yml @@ -8,7 +8,7 @@ how_to_implement: You must be ingesting data that records process activity from hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data - model. + model. Deprecated because the detection need rework and would need to work base on powershell logs. type: ESCU references: [] author: David Dorsey, Splunk diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index dad8911dab..c15373f7be 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -1,7 +1,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -version: 1 -date: '2018-11-02' +version: 2 +date: '2020-11-23' description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry @@ -18,15 +18,17 @@ references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND - Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, - Registry.registry_key_name Registry.status Registry.user Registry.registry_path - Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter`' + Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_name Registry.action | `drop_dm_object_name(Registry)` + | `monitor_registry_keys_for_print_monitors_filter`' known_false_positives: You will encounter noise from legitimate print-monitor registry entries. tags: analytics_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + mitre_attack_id: + - T1547.010 kill_chain_phases: - Actions on Objectives cis20: diff --git a/tests/endpoint/monitor_registry_keys_for_print_monitors.test.yml b/tests/endpoint/monitor_registry_keys_for_print_monitors.test.yml new file mode 100644 index 0000000000..490a0ab456 --- /dev/null +++ b/tests/endpoint/monitor_registry_keys_for_print_monitors.test.yml @@ -0,0 +1,10 @@ +name: Monitor Registry Keys for Print Monitors Unit Test +detections: +- name: Monitor Registry Keys for Print Monitors + file: endpoint/monitor_registry_keys_for_print_monitors.yml + pass_condition: '| stats count | where count > 0' +attack_data: +- file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1547.010/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog