admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

More_Registry

Browse Source
This commit is contained in:
tccontre
2022-03-08 12:42:34 +01:00
parent 3a4ec118b1
commit e7d85cbf1c
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_disable_logoff_button_through_registry.yml
+2 -1
View File
@@ -14,7 +14,8 @@ description: This analytic is to detect a suspicious registry modification to di
This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine
and users that can modify this registry is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoLogOff"
where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*"
Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff")
Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
Registry.registry_path Registry.registry_value_name Registry.registry_value_data
Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as