Branch was auto-updated.

detections/endpoint/active_setup_registry_autostart.yml

@@ -1,7 +1,7 @@
 name: Active Setup Registry Autostart
 id: f64579c0-203f-11ec-abcc-acde48001122
-version: 1
-date: '2021-09-28'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -13,12 +13,17 @@ description: This analytic is to detect a suspicious modification of the active
   do the modification since modification of this registry is not commonly done. check
   the legitimacy of the file and process involve in this rules to check if it is a
   valid setup installer that creating or modifying this registry.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name
-  = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed
-  Components*" by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
+  where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `active_setup_registry_autostart_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/add_defaultuser_and_password_in_registry.yml

@@ -1,7 +1,7 @@
 name: Add DefaultUser And Password In Registry
 id: d4a3eb62-0f1e-11ec-a971-acde48001122
-version: 1
-date: '2021-09-06'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -12,12 +12,18 @@ description: this search is to detect a suspicious registry modification to impl
   continue encrypting the whole network. This behavior is not a common practice and
   really a suspicious TTP or alert need to be consider if found within then network
   premise.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
-  NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword
-  OR Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" 
+  AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `add_defaultuser_and_password_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -1,7 +1,7 @@
 name: Allow Inbound Traffic By Firewall Rule Registry
 id: 0a46537c-be02-11eb-92ca-acde48001122
-version: 1
-date: '2021-05-26'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,13 +10,21 @@ description: This analytic detects a potential suspicious modification of firewa
   rule registry allowing inbound traffic in specific port with public profile. This
   technique was identified when an adversary wants to grant remote access to a machine
   by allowing the traffic in a firewall rule.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
-  Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
-  "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name
-  = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" 
+  Registry.registry_value_data = "*|Action=Allow|*" 
+  Registry.registry_value_data = "*|Dir=In|*" 
+  Registry.registry_value_data = "*|Profile=Public|*" 
+  Registry.registry_value_data = "*|LPort=*" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/allow_operation_with_consent_admin.yml

@@ -1,7 +1,7 @@
 name: Allow Operation with Consent Admin
 id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,12 +11,19 @@ description: This analytic identifies a potential privilege escalation attempt t
   Admin` to perform an operation that requires elevation without consent or credentials.
   We also found this in some attacker to gain privilege escalation to the compromise
   machine.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
-  Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
-  = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data
-  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" 
+  Registry.registry_value_name = ConsentPromptBehaviorAdmin 
+  Registry.registry_value_data = "0x00000000" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `allow_operation_with_consent_admin_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/disable_amsi_through_registry.yml

@@ -1,7 +1,7 @@
 name: Disable AMSI Through Registry
 id: 9c27ec42-d338-11eb-9044-acde48001122
-version: 1
-date: '2021-06-22'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,11 +10,17 @@ description: this search is to identify modification in registry to disable AMSI
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
-  Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by Registry.registry_path
-  Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_amsi_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/disable_defender_antivirus_registry.yml

@@ -1,7 +1,7 @@
 name: Disable Defender AntiVirus Registry
 id: aa4f695a-3024-11ec-9987-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,12 +11,18 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_key_name = DisableAntiVirus Registry.registry_value_name="DWORD (0x00000001)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data 
-| `drop_dm_object_name(Registry)` 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
-| `disable_defender_antivirus_registry_filter`'
+
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
+  | `disable_defender_antivirus_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_blockatfirstseen_feature.yml

@@ -1,7 +1,7 @@
 name: Disable Defender BlockAtFirstSeen Feature
 id: 2dd719ac-3021-11ec-97b4-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras
 type: TTP
 datamodel:
@@ -10,12 +10,17 @@ description: This analytic is to detect a suspicious modification of registry to
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the BlockAtFirstSeen feature where it block
   suspicious file first seen in the host.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
-  Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data
-  = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_defender_blockatfirstseen_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_enhanced_notification.yml

@@ -1,7 +1,7 @@
 name: Disable Defender Enhanced Notification
 id: dc65678c-301f-11ec-8e30-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,12 +10,17 @@ description: This analytic is to detect a suspicious modification of registry to
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the Enhanced Notification feature wher user
   or admin set to show or display alerts.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows
-  Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications
-  Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path
-  Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_defender_enhanced_notification_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data executions
   from your endpoints. If you are using Sysmon, you must have at least version 6.0.4

detections/endpoint/disable_defender_mpengine_registry.yml

@@ -1,7 +1,7 @@
 name: Disable Defender MpEngine Registry
 id: cc391750-3024-11ec-955a-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,12 +11,17 @@ description: This particular behavior is typically executed when an adversaries
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows
-  Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data
-  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_defender_mpengine_registry_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -1,7 +1,7 @@
 name: Disable Defender Spynet Reporting
 id: 898debf4-3021-11ec-ba7c-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -9,12 +9,17 @@ datamodel:
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the spynet reporting for its telemetry.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
-  Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data
-  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_defender_spynet_reporting_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/disable_defender_submit_samples_consent_feature.yml

@@ -1,7 +1,7 @@
 name: Disable Defender Submit Samples Consent Feature
 id: 73922ff8-3022-11ec-bf5e-acde48001122
-version: 1
-date: '2021-10-18'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -9,12 +9,17 @@ datamodel:
 description: his analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the submit samples feature for further analysis..
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows
-  Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data
-  = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
-  Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`'
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
+  where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `disable_defender_submit_samples_consent_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the registry value name, registry path, and registry value data from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -1,16 +1,14 @@
 name: Registry Keys Used For Persistence
 id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-version: 6
-date: '2021-09-07'
-author: Jose Hernandez, David Dorsey, Splunk
+version: 7
+date: '2022-01-26'
+author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
-  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
   OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit*
   OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run*
@@ -23,8 +21,15 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
   AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
   AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session
   Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run"
-  AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user |
-  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  AND Registry.registry_key_name="auto_update"))
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `registry_keys_used_for_persistence_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -1,20 +1,26 @@
 name: Registry Keys Used For Privilege Escalation
 id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
-version: 4
-date: '2020-11-27'
-author: David Dorsey, Splunk
+version: 5
+date: '2022-01-26'
+author: David Dorsey, Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
 description: This search looks for modifications to registry keys that can be used
   to elevate privileges. The registry keys under "Image File Execution Options" are
   used to intercept calls to an executable and can be used to attach malicious binaries
   to benign system binaries.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows
-  NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag
-  OR Registry.registry_value_name=Debugger) by Registry.dest  Registry.user Registry.registry_path
-  Registry.registry_value_name | `security_content_ctime(lastTime)`  | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
+  where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") 
+  AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+  | `registry_keys_used_for_privilege_escalation_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/remcos_client_registry_install_entry.yml

@@ -1,18 +1,24 @@
 name: Remcos client registry install entry
 id: f2a1615a-1d63-11ec-97d2-acde48001122
-version: 1
-date: '2021-09-24'
-author: Bhavin Patel, Rod Soto, Splunk
+version: 2
+date: '2022-01-26'
+author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This search detects registry key license at host where Remcos RAT agent
   is installed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Registry.registry_path) as  registry_path FROM datamodel=Endpoint.Registry
-  where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest  Registry.user
-  Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  where (Registry.registry_key_name=*\\Software\\Remcos*) 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  |`remcos_client_registry_install_entry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure

detections/endpoint/revil_registry_entry.yml

@@ -1,7 +1,7 @@
 name: Revil Registry Entry
 id: e3d3f57a-c381-11eb-9e35-acde48001122
-version: 1
-date: '2021-06-02'
+version: 2
+date: '2021-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,13 +11,17 @@ description: This analytic identifies suspicious modification in registry entry
   implant, malware and ransomware like REVIL where it keep some information like the
   random generated file extension it uses for all the encrypted files and ransomware
   notes file name in the compromised host.
-search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
-  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
-  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
-  OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name
-  = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name
-  Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
+search: '| tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry 
+  where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
+  | `revil_registry_entry_filter`'
 how_to_implement: to successfully implement this search, you need to be ingesting
   logs with the Image, TargetObject registry key, registry Details from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

detections/endpoint/start_up_during_safe_mode_boot.yml

@@ -1,7 +1,7 @@
 name: Start Up During Safe Mode Boot
 id: c6149154-c9d8-11eb-9da7-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -9,11 +9,17 @@ datamodel:
 description: This search is to detect a modification or registry add to the safeboot
   registry as an autostart mechanism. This technique was seen in some ransomware to
   automatically execute its code upon a safe mode boot.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
-  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` | `start_up_during_safe_mode_boot_filter`'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
+  | `start_up_during_safe_mode_boot_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response

detections/endpoint/time_provider_persistence_registry.yml

@@ -1,21 +1,26 @@
 name: Time Provider Persistence Registry
 id: 5ba382c4-2105-11ec-8d8f-acde48001122
-version: 1
-date: '2021-09-29'
+version: 2
+date: '2022-01-26'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspiciouos modification of time provider
+description: This analytic is to detect a suspicious modification of time provider
   registry for persistence and autostart. This technique can allow the attacker to
   persist on the compromised host and autostart as soon as the machine boot up. This
   TTP can be a good indicator of suspicious behavior since this registry is not commonly
   modified by normal user or even an admin.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
-  ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest  Registry.user
-  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
-  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" 
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid
+  | `drop_dm_object_name(Registry)` 
+  |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+  | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data
   | `time_provider_persistence_registry_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model