admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_registry_certificate_added.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-04-12 15:29:20 -06:00
parent 790b753e70
commit cab258e211
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_registry_certificate_added.yml
+1 -1
View File
@@ -10,7 +10,7 @@ description: 'The following analytic identifies installation of a root CA certif
The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "<THUMBPRINT_VALUE>\Blob" as this indicates the direct installation or modification of a root certificate binary blob.
The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.'
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path IN ("*\\Certificates\\*") AND Registry.registry_value_name="Blob"
where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob"
by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
| `drop_dm_object_name(Registry)`
| join process_guid _time