From cd46d4cf61a0c201112a70271f601b0baefae1bd Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 11 Oct 2021 11:05:34 +0200
Subject: [PATCH] Delete screensaver_event_trigger_execution.yml

---
 .../screensaver_event_trigger_execution.yml   | 68 -------------------
 1 file changed, 68 deletions(-)
 delete mode 100644 detections/endpoint/screensaver_event_trigger_execution.yml

diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml
deleted file mode 100644
index dd457c5f95..0000000000
--- a/detections/endpoint/screensaver_event_trigger_execution.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-name: Screensaver Event Trigger Execution 
-id: 58cea3ec-1f6d-11ec-8560-acde48001122
-version: 1
-date: '2021-09-27'
-author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
-description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification. 
-  This technique was seen in several APT and malware where they put the malicious payload path to the SCRNSAVE.EXE registry key to redirect the execution 
-  to their malicious payload path. This TTP is a good indicator that some attacker may modify this entry for their persistence and privilege escalation.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control Panel\\Desktop\\SCRNSAVE.EXE*")  
-  by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
-  | `security_content_ctime(lastTime)`  
-  | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` 
-  | `screensaver_event_trigger_execution_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
--  https://attack.mitre.org/techniques/T1546/002/
--  https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver
-tags:
-  analytic_story:
-  - Windows Persistence Techniques
-  - Windows Privilege Escalation
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1546.002
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Registry.dest 
-  - Registry.user 
-  - Registry.registry_path 
-  - Registry.registry_key_name 
-  - Registry.registry_value_name 
-  security_domain: endpoint
-  impact: 80
-  confidence: 90
-  # (impact * confidence)/100
-  risk_score: 72
-  context:
-  - source:endpoint
-  - stage:Privilege Escalation Persistence
-  message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: user
-    type: user
-    role:
-    - Victim
-  
\ No newline at end of file