From cef780f011e412bd5bae35dd3d17d87b173bfd73 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 2 Mar 2023 07:08:40 -0700
Subject: [PATCH] Update suspicious_regsvr32_register_suspicious_path.yml

---
 ...ious_regsvr32_register_suspicious_path.yml | 59 ++++++++++++++-----
 1 file changed, 45 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 7c32281b0d..1da6809953 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -1,20 +1,18 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-28'
+version: 3
+date: '2023-03-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
-  by using non-standard file extensions to load malciious DLLs. Upon investigating,
+  by using non-standard file extensions to load DLLs. Upon investigating,
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
-  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
-  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*"))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
@@ -54,22 +52,29 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Suspicious $Processes.process_path.file_path$ process potentially loading
-    malicious code
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension. 
   mitre_attack_id:
   - T1218
   - T1218.010
   nist:
   - DE.CM
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: dest
+    type: Hostname
     role:
-    - Attacker
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -91,3 +96,29 @@ tags:
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+
+  impact: 80
+  confidence: 100
+  # (impact * confidence)/100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of parent_process_name$ spawning process_name$ was identified on endpoint Computer$ by user user$ attempting to decode a file.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file