From 71594365772427e043b757b85c7418fa2a1392e4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 26 Jan 2022 11:20:07 +0100 Subject: [PATCH 01/67] reg_yml_analytics_updates --- .../active_setup_registry_autostart.yml | 17 +++++++++----- ...d_defaultuser_and_password_in_registry.yml | 18 ++++++++++----- ...ound_traffic_by_firewall_rule_registry.yml | 22 +++++++++++++------ .../allow_operation_with_consent_admin.yml | 19 +++++++++++----- .../disable_amsi_through_registry.yml | 16 +++++++++----- .../disable_defender_antivirus_registry.yml | 17 +++++++++----- ...able_defender_blockatfirstseen_feature.yml | 17 +++++++++----- ...disable_defender_enhanced_notification.yml | 17 +++++++++----- .../disable_defender_mpengine_registry.yml | 17 +++++++++----- .../disable_defender_spynet_reporting.yml | 17 +++++++++----- ...efender_submit_samples_consent_feature.yml | 17 +++++++++----- .../registry_keys_used_for_persistence.yml | 17 +++++++++----- ...try_keys_used_for_privilege_escalation.yml | 20 +++++++++++------ .../remcos_client_registry_install_entry.yml | 16 +++++++++----- detections/endpoint/revil_registry_entry.yml | 18 +++++++++------ .../start_up_during_safe_mode_boot.yml | 16 +++++++++----- .../time_provider_persistence_registry.yml | 17 +++++++++----- 17 files changed, 196 insertions(+), 102 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 424bc13108..ba5323a80d 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -13,12 +13,17 @@ description: This analytic is to detect a suspicious modification of the active do the modification since modification of this registry is not commonly done. check the legitimacy of the file and process involve in this rules to check if it is a valid setup installer that creating or modifying this registry. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_value_name - = "StubPath" Registry.registry_key_name = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed - Components*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name - Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `active_setup_registry_autostart_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components*" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `active_setup_registry_autostart_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index a8e02042e2..02db987c95 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -12,12 +12,18 @@ description: this search is to detect a suspicious registry modification to impl continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows - NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name= DefaultPassword - OR Registry.registry_value_name= DefaultUserName by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `add_defaultuser_and_password_in_registry_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" + AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name= DefaultUserName + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name + | `add_defaultuser_and_password_in_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index c82db7194b..5bb8c2cd9a 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -10,13 +10,21 @@ description: This analytic detects a potential suspicious modification of firewa rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = - "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name - = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" + Registry.registry_value_name = "*|Action=Allow|*" + Registry.registry_value_name = "*|Dir=In|*" + Registry.registry_value_name = "*|Profile=Public|*" + Registry.registry_value_name = "*|LPort=*" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name + | `allow_inbound_traffic_by_firewall_rule_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index f686eb598b..22cb7f9a77 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -11,12 +11,19 @@ description: This analytic identifies a potential privilege escalation attempt t Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" - Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data - = "0x00000000" by Registry.registry_path Registry.registry_key_name Registry.registry_value_data - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" + Registry.registry_value_name = ConsentPromptBehaviorAdmin + Registry.registry_value_data = "0x00000000" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name + | `allow_operation_with_consent_admin_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 710b32e57e..a9e1977a29 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -10,11 +10,17 @@ description: this search is to identify modification in registry to disable AMSI feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute payload with minimal alert as much as possible. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows - Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by Registry.registry_path - Registry.registry_key_name Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_amsi_through_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 64c22443d4..e1296cac83 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -11,12 +11,17 @@ description: This particular behavior is typically executed when an adversaries detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows - Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data - = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_defender_antivirus_registry_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name = DisableAntiVirus Registry.registry_value_data = 0x00000001 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_antivirus_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 58020d56e1..1b525468a1 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -10,12 +10,17 @@ description: This analytic is to detect a suspicious modification of registry to windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows - Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data - = 0x00000001 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_defender_blockatfirstseen_feature_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_blockatfirstseen_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index c1c61d9e9d..5c43ce6d6c 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -10,12 +10,17 @@ description: This analytic is to detect a suspicious modification of registry to windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*Microsoft\\Windows - Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications - Registry.registry_value_data = 0x00000001 by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name Registry.registry_value_data | `drop_dm_object_name(Registry)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `disable_defender_enhanced_notification_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_enhanced_notification_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 1314ebbd59..a1c356049b 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -11,12 +11,17 @@ description: This particular behavior is typically executed when an adversaries detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows - Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data - = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_defender_mpengine_registry_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*" Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_mpengine_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 591a7c90ff..19aa223d55 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -9,12 +9,17 @@ datamodel: description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows - Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data - = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_defender_spynet_reporting_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SpynetReporting Registry.registry_value_data = 0x00000000 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_spynet_reporting_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index c40ed524a5..b5b7f010ee 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -9,12 +9,17 @@ datamodel: description: his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows - Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data - = 0x00000000 by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name - Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` | `disable_defender_submit_samples_consent_feature_filter`' +search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry + where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `disable_defender_submit_samples_consent_feature_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 19cfceef0d..1f352eb1ad 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -2,15 +2,13 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 6 date: '2021-09-07' -author: Jose Hernandez, David Dorsey, Splunk +author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* @@ -23,8 +21,15 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" - AND Registry.registry_key_name="auto_update")) by Registry.dest Registry.user | - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + AND Registry.registry_key_name="auto_update")) + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 22362f7da6..bd9c7b4de3 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -2,19 +2,25 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 4 date: '2020-11-27' -author: David Dorsey, Splunk +author: David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: [] description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows - NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_value_name=GlobalFlag - OR Registry.registry_value_name=Debugger) by Registry.dest Registry.user Registry.registry_path - Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") + AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger) + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name + | `registry_keys_used_for_privilege_escalation_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 9e3d861d01..b0b4f166a7 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -8,11 +8,17 @@ datamodel: - Endpoint description: This search detects registry key license at host where Remcos RAT agent is installed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry - where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user - Registry.registry_key_name Registry.process_id| `drop_dm_object_name(Registry)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`remcos_client_registry_install_entry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where (Registry.registry_key_name=*\\Software\\Remcos*) + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + |`remcos_client_registry_install_entry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index cebc65361d..9d716e300b 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -11,13 +11,17 @@ description: This analytic identifies suspicious modification in registry entry implant, malware and ransomware like REVIL where it keep some information like the random generated file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. -search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) - as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" - OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") AND (Registry.registry_value_name - = "\.*" OR Registry.registry_value_name = "Binary Data") by Registry.registry_value_name - Registry.dest Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `revil_registry_entry_filter`' how_to_implement: to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index b4f49a32f1..785707c98e 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -9,11 +9,17 @@ datamodel: description: This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" - by Registry.registry_path Registry.registry_key_name Registry.registry_value_name - Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `start_up_during_safe_mode_boot_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data + | `start_up_during_safe_mode_boot_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index e27d0729a9..109058080f 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -6,16 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This analytic is to detect a suspiciouos modification of time provider +description: This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This TTP can be a good indicator of suspicious behavior since this registry is not commonly modified by normal user or even an admin. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime - max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path - ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by Registry.dest Registry.user - Registry.registry_path Registry.registry_key_name Registry.registry_value_name | - `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry + where Registry.registry_path ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" + by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)` + |rename process_guid as proc_guid + | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] + | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model From ada0fe5bf3f320ff8e370ebc4b43e6e480357ee9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:22:20 +0100 Subject: [PATCH 02/67] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index ba5323a80d..cfdad6b5d9 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 version: 1 -date: '2021-09-28' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 941c3e49247a4c0c55d5aeb6ff74c748e5334b6b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:22:32 +0100 Subject: [PATCH 03/67] Update add_defaultuser_and_password_in_registry.yml --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 02db987c95..824aaee4f8 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 1 -date: '2021-09-06' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: From 5de9c40af14ce5958197e1bcc846a12254920b21 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:22:44 +0100 Subject: [PATCH 04/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 5bb8c2cd9a..f4bf72b3ec 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 version: 1 -date: '2021-05-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 58369314a9a2897d66f2f11520200231726602b6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:22:55 +0100 Subject: [PATCH 05/67] Update allow_operation_with_consent_admin.yml --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 22cb7f9a77..533bba01ba 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 1 -date: '2021-06-10' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 441ae1b3a812dd9cf7cd7cf62655918142ba0fa4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:23:08 +0100 Subject: [PATCH 06/67] Update disable_amsi_through_registry.yml --- detections/endpoint/disable_amsi_through_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index a9e1977a29..6a60ae22d4 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,7 +1,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 1 -date: '2021-06-22' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From c7d6287be9fcea577adb873b4c0c0f0a7be91154 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:23:19 +0100 Subject: [PATCH 07/67] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index e1296cac83..28446a3976 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 1 -date: '2021-10-18' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From d133a6b36d5dde226d61934a049844351fffeb6f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:23:31 +0100 Subject: [PATCH 08/67] Update disable_defender_blockatfirstseen_feature.yml --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 1b525468a1..24a110e318 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 version: 1 -date: '2021-10-18' +date: '2022-01-26' author: Teoderick Contreras type: TTP datamodel: From 626f16dada5021984b3946689c98437cb7bf9c73 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:23:42 +0100 Subject: [PATCH 09/67] Update disable_defender_enhanced_notification.yml --- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 5c43ce6d6c..c28bdafe24 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,7 +1,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 1 -date: '2021-10-18' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 272d28f5de7aac8c6581ee9543a2b8e67bffa78a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:24:38 +0100 Subject: [PATCH 10/67] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index cfdad6b5d9..d9b7e17ba7 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,6 +1,6 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From 34556d7e86fc34e37d9fa7416f8870c6fa67b14d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:24:53 +0100 Subject: [PATCH 11/67] Update add_defaultuser_and_password_in_registry.yml --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 824aaee4f8..4595e0e2b6 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,6 +1,6 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: Anomaly From ddc14a55d0fc67e07557de8b36370cd19f660a69 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:25:04 +0100 Subject: [PATCH 12/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index f4bf72b3ec..d0fe90a3e5 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,6 +1,6 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From abc1202e26d658db94f203da975338af6fe9bfea Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:25:19 +0100 Subject: [PATCH 13/67] Update allow_operation_with_consent_admin.yml --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 533bba01ba..b17162e1ca 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,6 +1,6 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From 250ed063d40e72acaff683d94ec00e0d1ca50131 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:25:31 +0100 Subject: [PATCH 14/67] Update disable_amsi_through_registry.yml --- detections/endpoint/disable_amsi_through_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 6a60ae22d4..15b192086a 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,6 +1,6 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From 58d480b0f63c43f2fc326601d38dddf4e268b4c7 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:25:43 +0100 Subject: [PATCH 15/67] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 28446a3976..1c410b5f2a 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,6 +1,6 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From 9ffff5beded6718b84000d62730eb69a5c5aa048 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:25:53 +0100 Subject: [PATCH 16/67] Update disable_defender_blockatfirstseen_feature.yml --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 24a110e318..61fb400ab2 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,6 +1,6 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras type: TTP From f4a71d40d63ab7e77fac38bb156354ff9e6c14c2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:26:04 +0100 Subject: [PATCH 17/67] Update disable_defender_enhanced_notification.yml --- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index c28bdafe24..3c5eafbc45 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,6 +1,6 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 -version: 1 +version: 2 date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP From e0edf84ca380de529e7ce413091374fa75f12279 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:26:28 +0100 Subject: [PATCH 18/67] Update disable_defender_mpengine_registry.yml --- detections/endpoint/disable_defender_mpengine_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index a1c356049b..f164a870f9 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,6 +1,6 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 -version: 1 +version: 2 date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP From d137c3f6c1829cd695a845e992fb83f241d2c200 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:27:21 +0100 Subject: [PATCH 19/67] Update time_provider_persistence_registry.yml --- detections/endpoint/time_provider_persistence_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 109058080f..b5b9b07fa9 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,6 +1,6 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 1 +version: 2 date: '2021-09-29' author: Teoderick Contreras, Splunk type: TTP From 366ea098695b4a98e6701d53480b4d296564e581 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:27:33 +0100 Subject: [PATCH 20/67] Update start_up_during_safe_mode_boot.yml --- detections/endpoint/start_up_during_safe_mode_boot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index 785707c98e..e347554cac 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -1,6 +1,6 @@ name: Start Up During Safe Mode Boot id: c6149154-c9d8-11eb-9da7-acde48001122 -version: 1 +version: 2 date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP From 91f273cbeab20f02ace2c4fdd87ae2a932f434c2 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:27:51 +0100 Subject: [PATCH 21/67] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index d9b7e17ba7..f402f7dca2 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-09-28' author: Teoderick Contreras, Splunk type: TTP datamodel: From 109b9e5b37981310b1087bdf771da43438410a33 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:28:09 +0100 Subject: [PATCH 22/67] Update add_defaultuser_and_password_in_registry.yml --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 4595e0e2b6..89b93ced77 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-09-06' author: Teoderick Contreras, Splunk type: Anomaly datamodel: From 9a60a7e41aab1f677f3dbbf031cc6a5752be2e79 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:28:23 +0100 Subject: [PATCH 23/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index d0fe90a3e5..176bf41080 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-05-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 9b6ab3bacc7d71a71d35eb874732187810308517 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:28:37 +0100 Subject: [PATCH 24/67] Update allow_operation_with_consent_admin.yml --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index b17162e1ca..2f3bd1f119 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: From 6017b8d8497eb2fa0521758790975a730a3fb47d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:28:51 +0100 Subject: [PATCH 25/67] Update disable_amsi_through_registry.yml --- detections/endpoint/disable_amsi_through_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 15b192086a..1722e1e1b5 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,7 +1,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: From 1df963880474c7f5f8b84a29570836585d588dd5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:29:12 +0100 Subject: [PATCH 26/67] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 1c410b5f2a..aa334bef76 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP datamodel: From 96ea6e6b16c8eca7250f5af215c091bb718e05f8 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:29:26 +0100 Subject: [PATCH 27/67] Update disable_defender_blockatfirstseen_feature.yml --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index 61fb400ab2..cc2c8149ff 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-10-18' author: Teoderick Contreras type: TTP datamodel: From cbd343b844d120a68e531e5f27fa9ea8e4452c9d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:29:42 +0100 Subject: [PATCH 28/67] Update disable_defender_enhanced_notification.yml --- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 3c5eafbc45..0cf362383b 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,7 +1,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 -date: '2022-01-26' +date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP datamodel: From efb7c610632048f67d4d8534d19965355300fefa Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:29:54 +0100 Subject: [PATCH 29/67] Update disable_defender_spynet_reporting.yml --- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 19aa223d55..2e37aaac45 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,6 +1,6 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 -version: 1 +version: 2 date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP From 6d14d192ee63a1f035ca32eaab52ebfe49674965 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:30:17 +0100 Subject: [PATCH 30/67] Update revil_registry_entry.yml --- detections/endpoint/revil_registry_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 9d716e300b..dbe1f149eb 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,6 +1,6 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 -version: 1 +version: 2 date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP From c6082b53531415ca3afa8de5364c5c70348063af Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:30:31 +0100 Subject: [PATCH 31/67] Update remcos_client_registry_install_entry.yml --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index b0b4f166a7..02eeab33a4 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,6 +1,6 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 -version: 1 +version: 2 date: '2021-09-24' author: Bhavin Patel, Rod Soto, Splunk type: TTP From c92c8000350f0a73d9f4222723f0d91a9a263110 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:30:48 +0100 Subject: [PATCH 32/67] Update remcos_client_registry_install_entry.yml --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 02eeab33a4..7e7537b02e 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -2,7 +2,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 date: '2021-09-24' -author: Bhavin Patel, Rod Soto, Splunk +author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint From b5ee46bc9b554d56f4a8877f9b4707921d11083e Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:31:15 +0100 Subject: [PATCH 33/67] Update registry_keys_used_for_persistence.yml --- detections/endpoint/registry_keys_used_for_persistence.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 1f352eb1ad..d50cd0b38d 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,6 +1,6 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 6 +version: 7 date: '2021-09-07' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk type: TTP From 41101fbf594aee78bae233e0547024d15a21ae79 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:31:28 +0100 Subject: [PATCH 34/67] Update disable_defender_submit_samples_consent_feature.yml --- .../disable_defender_submit_samples_consent_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index b5b7f010ee..b6635d9133 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,6 +1,6 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 -version: 1 +version: 2 date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP From bf995a8d45db0088ac0cf761ae6455b160d86797 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:34:25 +0100 Subject: [PATCH 35/67] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index f402f7dca2..fe63688155 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 version: 2 -date: '2021-09-28' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 4eb093adcbeb9ecf8f8074b40a2ebb920451282b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:34:36 +0100 Subject: [PATCH 36/67] Update add_defaultuser_and_password_in_registry.yml --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 89b93ced77..cc8c8150ac 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 -date: '2021-09-06' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: From 94e528ed87e990424c68e3713e18503d0a860fb0 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:34:51 +0100 Subject: [PATCH 37/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 176bf41080..85e7cebab2 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 version: 2 -date: '2021-05-26' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 67cf8b96fc04c6c619047b4eb2daeeddccc39745 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:02 +0100 Subject: [PATCH 38/67] Update allow_operation_with_consent_admin.yml --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 2f3bd1f119..4b71b91011 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 2 -date: '2021-06-10' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 10235f204ad15dd2072ca4c2fa6fa4527fa45df6 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:14 +0100 Subject: [PATCH 39/67] Update disable_amsi_through_registry.yml --- detections/endpoint/disable_amsi_through_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 1722e1e1b5..d9d04bf37d 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,7 +1,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 2 -date: '2021-06-22' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 11d5f6a78e68843f2c6dcd4a413d1cafb90e7ab3 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:26 +0100 Subject: [PATCH 40/67] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index aa334bef76..dbb7f4db53 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 7cdf1a75016268475c4b2c9facb0f3229e390607 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:36 +0100 Subject: [PATCH 41/67] Update disable_defender_blockatfirstseen_feature.yml --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index cc2c8149ff..a9a5fdfc9b 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras type: TTP datamodel: From b466ccb66b2851d6019be5f710045dcc503b3bad Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:46 +0100 Subject: [PATCH 42/67] Update disable_defender_enhanced_notification.yml --- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 0cf362383b..19574f4467 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,7 +1,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 9cb8b0f08c9f6edb0be952ecca26f93198e5ffbb Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:35:57 +0100 Subject: [PATCH 43/67] Update disable_defender_mpengine_registry.yml --- detections/endpoint/disable_defender_mpengine_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index f164a870f9..b6ce12aeed 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From fe4da2500443d9fb6642e2a021050f29adb82444 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:36:10 +0100 Subject: [PATCH 44/67] Update disable_defender_spynet_reporting.yml --- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 2e37aaac45..0930de5f91 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,7 +1,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From b161a606fd85ed5273b80a88bb2fe537c77a93f5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:36:41 +0100 Subject: [PATCH 45/67] Update disable_defender_submit_samples_consent_feature.yml --- .../disable_defender_submit_samples_consent_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index b6635d9133..1504d68fe4 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 version: 2 -date: '2021-10-18' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 0f69994a73fa35a440b2afaa4507198b9a923a7f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:36:54 +0100 Subject: [PATCH 46/67] Update registry_keys_used_for_persistence.yml --- detections/endpoint/registry_keys_used_for_persistence.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d50cd0b38d..898a530741 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 7 -date: '2021-09-07' +date: '2021-01-26' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: From a5581d4005486117974fa777e8d8d2dd1c8abdf3 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:37:08 +0100 Subject: [PATCH 47/67] Update remcos_client_registry_install_entry.yml --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 7e7537b02e..e3ad833c8e 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,7 +1,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 -date: '2021-09-24' +date: '2021-01-26' author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: From 3fb82f029d6ce058ea5569e0175332b193ff758c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:37:21 +0100 Subject: [PATCH 48/67] Update revil_registry_entry.yml --- detections/endpoint/revil_registry_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index dbe1f149eb..3a40434e33 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -1,7 +1,7 @@ name: Revil Registry Entry id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 2 -date: '2021-06-02' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 21e55e786fa3834c92d142281207962325d9fac4 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:37:34 +0100 Subject: [PATCH 49/67] Update start_up_during_safe_mode_boot.yml --- detections/endpoint/start_up_during_safe_mode_boot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index e347554cac..fb6f2f5bfc 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -1,7 +1,7 @@ name: Start Up During Safe Mode Boot id: c6149154-c9d8-11eb-9da7-acde48001122 version: 2 -date: '2021-06-10' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From fda14b6eff42863b4be995c6c0b3ec98b47bf1a5 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:37:52 +0100 Subject: [PATCH 50/67] Update time_provider_persistence_registry.yml --- detections/endpoint/time_provider_persistence_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index b5b9b07fa9..b0efea5949 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,7 +1,7 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 version: 2 -date: '2021-09-29' +date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 11efabfcc7aa072d059e510074a8284c54230ad1 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:38:21 +0100 Subject: [PATCH 51/67] Update active_setup_registry_autostart.yml --- detections/endpoint/active_setup_registry_autostart.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index fe63688155..d9b7e17ba7 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -1,7 +1,7 @@ name: Active Setup Registry Autostart id: f64579c0-203f-11ec-abcc-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 8a5cd4b7c8d233a01f59b10215ba7833fa2cbf8d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:38:33 +0100 Subject: [PATCH 52/67] Update add_defaultuser_and_password_in_registry.yml --- .../endpoint/add_defaultuser_and_password_in_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index cc8c8150ac..4595e0e2b6 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -1,7 +1,7 @@ name: Add DefaultUser And Password In Registry id: d4a3eb62-0f1e-11ec-a971-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: From 183e8cdd0d3a7407cef7f6f7f521b3a9aea87fd7 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:38:47 +0100 Subject: [PATCH 53/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 85e7cebab2..d0fe90a3e5 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -1,7 +1,7 @@ name: Allow Inbound Traffic By Firewall Rule Registry id: 0a46537c-be02-11eb-92ca-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 0d575b49f997761de1280c5001238afd41f67255 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:38:57 +0100 Subject: [PATCH 54/67] Update allow_operation_with_consent_admin.yml --- detections/endpoint/allow_operation_with_consent_admin.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 4b71b91011..b17162e1ca 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -1,7 +1,7 @@ name: Allow Operation with Consent Admin id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 4decf3f72ba7036a033fed7a9ba0ed69c22f1af3 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:39:08 +0100 Subject: [PATCH 55/67] Update disable_amsi_through_registry.yml --- detections/endpoint/disable_amsi_through_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index d9d04bf37d..15b192086a 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -1,7 +1,7 @@ name: Disable AMSI Through Registry id: 9c27ec42-d338-11eb-9044-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 644644675b298d6a265dc7eef22b1352452686a7 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:39:27 +0100 Subject: [PATCH 56/67] Update disable_defender_antivirus_registry.yml --- detections/endpoint/disable_defender_antivirus_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index dbb7f4db53..1c410b5f2a 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender AntiVirus Registry id: aa4f695a-3024-11ec-9987-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From c69a14fb351ea7f1c74233eb08d9fcae4cba7dde Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:39:37 +0100 Subject: [PATCH 57/67] Update disable_defender_blockatfirstseen_feature.yml --- .../endpoint/disable_defender_blockatfirstseen_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index a9a5fdfc9b..61fb400ab2 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender BlockAtFirstSeen Feature id: 2dd719ac-3021-11ec-97b4-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras type: TTP datamodel: From abefdaef0678dcc93d4c88350efea035a0b16959 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:39:48 +0100 Subject: [PATCH 58/67] Update disable_defender_enhanced_notification.yml --- detections/endpoint/disable_defender_enhanced_notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 19574f4467..3c5eafbc45 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -1,7 +1,7 @@ name: Disable Defender Enhanced Notification id: dc65678c-301f-11ec-8e30-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 1db596ff6c207d720be71f89174e560c7600ee2b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:40:07 +0100 Subject: [PATCH 59/67] Update disable_defender_mpengine_registry.yml --- detections/endpoint/disable_defender_mpengine_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index b6ce12aeed..2e16e99cff 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -1,7 +1,7 @@ name: Disable Defender MpEngine Registry id: cc391750-3024-11ec-955a-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From eacd0a9534e51ce28596775a7909dca68a3ee755 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:40:18 +0100 Subject: [PATCH 60/67] Update disable_defender_spynet_reporting.yml --- detections/endpoint/disable_defender_spynet_reporting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 0930de5f91..22f3fccf77 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -1,7 +1,7 @@ name: Disable Defender Spynet Reporting id: 898debf4-3021-11ec-ba7c-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 3bcf548b83d9612bdfe1ee75864a08071bc8e8ca Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:40:35 +0100 Subject: [PATCH 61/67] Update disable_defender_submit_samples_consent_feature.yml --- .../disable_defender_submit_samples_consent_feature.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 1504d68fe4..79f33968cd 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -1,7 +1,7 @@ name: Disable Defender Submit Samples Consent Feature id: 73922ff8-3022-11ec-bf5e-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From bcdf46a631fdddd59c3382479a92e5792bbc1bd9 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:40:46 +0100 Subject: [PATCH 62/67] Update registry_keys_used_for_persistence.yml --- detections/endpoint/registry_keys_used_for_persistence.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 898a530741..1132cc8d98 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 7 -date: '2021-01-26' +date: '2022-01-26' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: From 708552a3d0271396e4ba2133bdee3d5290cc27ec Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:41:06 +0100 Subject: [PATCH 63/67] Update registry_keys_used_for_privilege_escalation.yml --- .../endpoint/registry_keys_used_for_privilege_escalation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index bd9c7b4de3..128a1bfc03 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e -version: 4 -date: '2020-11-27' +version: 5 +date: '2022-01-26' author: David Dorsey, Teoderick Contreras, Splunk type: TTP datamodel: [] From 28342ca7dc763ccbeb6df40be6c8e000b1b97a0a Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:41:25 +0100 Subject: [PATCH 64/67] Update remcos_client_registry_install_entry.yml --- detections/endpoint/remcos_client_registry_install_entry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index e3ad833c8e..7cdeef0c97 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -1,7 +1,7 @@ name: Remcos client registry install entry id: f2a1615a-1d63-11ec-97d2-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: From c792da85e8be93572a86c418b84c16ef3b439e43 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:41:47 +0100 Subject: [PATCH 65/67] Update start_up_during_safe_mode_boot.yml --- detections/endpoint/start_up_during_safe_mode_boot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index fb6f2f5bfc..26abd617b8 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -1,7 +1,7 @@ name: Start Up During Safe Mode Boot id: c6149154-c9d8-11eb-9da7-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From ec66a35885c51260502f306b9d410f958229af4d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 26 Jan 2022 11:42:05 +0100 Subject: [PATCH 66/67] Update time_provider_persistence_registry.yml --- detections/endpoint/time_provider_persistence_registry.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index b0efea5949..5b4dcff038 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,7 +1,7 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 version: 2 -date: '2021-01-26' +date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: From 46f2aeddfb39e2604dca5c161092e49e0808360d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 28 Jan 2022 11:04:23 +0100 Subject: [PATCH 67/67] Update allow_inbound_traffic_by_firewall_rule_registry.yml --- .../allow_inbound_traffic_by_firewall_rule_registry.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index d0fe90a3e5..2efb621292 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -12,10 +12,10 @@ description: This analytic detects a potential suspicious modification of firewa by allowing the traffic in a firewall rule. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - Registry.registry_value_name = "*|Action=Allow|*" - Registry.registry_value_name = "*|Dir=In|*" - Registry.registry_value_name = "*|Profile=Public|*" - Registry.registry_value_name = "*|LPort=*" + Registry.registry_value_data = "*|Action=Allow|*" + Registry.registry_value_data = "*|Dir=In|*" + Registry.registry_value_data = "*|Profile=Public|*" + Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes