diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml new file mode 100644 index 0000000000..92ad1fea19 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Auto Minor Updates +id: be498b9f-d804-4bbf-9fc0-d5448466b313 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will "Treat minor updates like other updates". +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates" + AND Registry.registry_value_data="0x00000000" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_auto_minor_updates_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 30 + impact: 30 + message: A registry modification in Windows auto update configuration on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 9 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml new file mode 100644 index 0000000000..f9895cc7a6 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry Auto Update Notif +id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update notification. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will switch the automatic windows update to "Notify before download". +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions" + AND Registry.registry_value_data="0x00000002" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_auto_update_notif_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A registry modification in Windows auto update notification on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml new file mode 100644 index 0000000000..0f8ea8a05d --- /dev/null +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -0,0 +1,66 @@ +name: Windows Modify Registry Disable WinDefender Notifications +id: 8e207707-ad40-4eb3-b865-3a52aec91f26 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification to disable Windows Defender notification. + This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. + RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications" + AND Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_disable_windefender_notifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A registry modification to disable Windows Defender notification on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml new file mode 100644 index 0000000000..e7626c0387 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -0,0 +1,70 @@ +name: Windows Modify Registry Do Not Connect To Win Update +id: e09c598e-8dd0-4e73-b740-4b96b689199e +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will disable Windos update functionality, and may cause connection to public services such as the Windows Store to stop working. + This policy applies only when this PC is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations" + AND Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_do_not_connect_to_win_update_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a registry modification in Windows auto update configuration in $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml new file mode 100644 index 0000000000..acc6dd1b97 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry No Auto Reboot With Logon User +id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will allow "Logged-on user gets to choose whether or not to restart his or her compute". +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers" + AND Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 30 + impact: 30 + message: A registry modification in Windows auto update configuration on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 9 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml new file mode 100644 index 0000000000..6f2e7be2b1 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry No Auto Update +id: fbd4f333-17bb-4eab-89cb-860fa2e0600e +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will "Disable Automatic Updates". +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate" + AND Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_no_auto_update_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A registry modification in Windows auto update configuration on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml new file mode 100644 index 0000000000..058432a56e --- /dev/null +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -0,0 +1,66 @@ +name: Windows Modify Registry Tamper Protection +id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification to tamper Windows Defender protection. + This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. + RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection" + AND Registry.registry_value_data="0x00000000" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_tamper_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A registry modification to tamper Windows Defender protection on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml new file mode 100644 index 0000000000..010600b1d3 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml @@ -0,0 +1,67 @@ +name: Windows Modify Registry UpdateServiceUrlAlternate +id: ca4e94fb-7969-4d63-8630-3625809a1f70 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that specifies an intranet server to host updates from Microsoft Update. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_updateserviceurlalternate_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A registry modification in Windows auto update configuration on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml new file mode 100644 index 0000000000..05d38144d8 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_usewuserver.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry USeWuServer +id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification that will use "The WUServer value unless this key is set". +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer" + AND Registry.registry_value_data="0x00000001" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_usewuserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a registry modification in Windows auto update configuration in $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml new file mode 100644 index 0000000000..91a9851d93 --- /dev/null +++ b/detections/endpoint/windows_modify_registry_wuserver.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry WuServer +id: a02ad386-e26d-44ce-aa97-6a46cee31439 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification related to the WSUS server used by Automatic Updates and (by default) API callers. + This policy is paired with WUStatusServer; both must be set to the same value in order for them to be valid. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_wuserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: Administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A registry modification in Windows auto update configuration on $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml new file mode 100644 index 0000000000..9c8a7a9ada --- /dev/null +++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml @@ -0,0 +1,68 @@ +name: Windows Modify Registry wuStatusServer +id: 073e69d0-68b2-4142-aa90-a7ee6f590676 +version: 1 +date: '2023-04-21' +author: Teoderick Contreras, Splunk +status: production +type: Hunting +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +- Sysmon EventID 14 +description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. + This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or + to be able to compromise the target host with zero day exploit or as an additional defense evasion technique. + RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host. + This detection looks for registry modification related to the server to which reporting information will be sent for client computers + that use the WSUS server configured by the WUServer key. This policy is paired with WUServer; both must be set to the same value in order for them to be valid. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry + where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer" + by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name + | `drop_dm_object_name(Registry)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `windows_modify_registry_wustatusserver_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: administrators may enable or disable this feature that may + cause some false positive. +references: +- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 +tags: + analytic_story: + - RedLine Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: a registry modification in Windows auto update configuration in $dest$ + mitre_attack_id: + - T1112 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_path + - Registry.user + - Registry.dest + - Registry.registry_value_name + - Registry.action + - Registry.registry_value_data + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/requirements.txt b/requirements.txt index 87e40ab02a..33378c2dd3 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,7 +4,7 @@ GitPython==3.1.31 Jinja2==3.1.2 jsonschema==4.17.3 mock==4.0.3 -psutil==5.9.4 +psutil==5.9.5 pycvesearch==1.2 pydantic==1.10.7 pysigma==0.9.8