From cab258e21144dabfe3670669d210190d3aecd8fe Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 12 Apr 2022 15:29:20 -0600 Subject: [PATCH] Update windows_registry_certificate_added.yml --- detections/endpoint/windows_registry_certificate_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index f05718ed6e..7d171d18f7 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -10,7 +10,7 @@ description: 'The following analytic identifies installation of a root CA certif The high-fidelity events to pay attention to are SetValue events where the TargetObject property ends with "\Blob" as this indicates the direct installation or modification of a root certificate binary blob. The other high fidelity reference will be which process is making the registry modifications. There are very few processes that modify these day to day, therefore monitoring for all to start (hunting) provides a great beginning.' search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry - where Registry.registry_path IN ("*\\Certificates\\*") AND Registry.registry_value_name="Blob" + where Registry.registry_path IN ("*\\certificates\\*") AND Registry.registry_value_name="Blob" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time