From a5f824e4b8842898c90015009d7f7e789efd2e99 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 26 Apr 2023 15:38:56 +0200
Subject: [PATCH 01/15] do_not_step_on_the_redline2

---
 ...dows_modify_registry_auto_update_notif.yml | 66 ++++++++++++++++++
 ...stry_disable_windefender_notifications.yml | 64 +++++++++++++++++
 ..._registry_do_not_connect_to_win_update.yml | 68 +++++++++++++++++++
 ...egistry_no_auto_reboot_with_logon_user.yml | 66 ++++++++++++++++++
 ...windows_modify_registry_no_auto_update.yml | 66 ++++++++++++++++++
 ...dows_modify_registry_tamper_protection.yml | 64 +++++++++++++++++
 6 files changed, 394 insertions(+)
 create mode 100644 detections/endpoint/windows_modify_registry_auto_update_notif.yml
 create mode 100644 detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
 create mode 100644 detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
 create mode 100644 detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
 create mode 100644 detections/endpoint/windows_modify_registry_no_auto_update.yml
 create mode 100644 detections/endpoint/windows_modify_registry_tamper_protection.yml

diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
new file mode 100644
index 0000000000..a37db5d23d
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry Auto Update Notif
+id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update notification. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will switch the automatic windows update to "Notify before download".
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AUOptions"
+  AND Registry.registry_value_data="0x00000002" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_auto_update_notif_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update notification in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
new file mode 100644
index 0000000000..c3a55322c1
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
@@ -0,0 +1,64 @@
+name: Windows Modify Registry Disable WinDefender Notifications
+id: 8e207707-ad40-4eb3-b865-3a52aec91f26
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification to disable Windows Defender notification. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. 
+  RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications\\DisableNotifications"
+  AND Registry.registry_value_data="0x00000001" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_disable_windefender_notifications_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: a registry modification to disable Windows Defender notification in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
new file mode 100644
index 0000000000..66c6cc97d7
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
@@ -0,0 +1,68 @@
+name: Windows Modify Registry Do Not Connect To Win Update
+id: e09c598e-8dd0-4e73-b740-4b96b689199e
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will disable Windos update functionality, and may cause connection to public services such as the Windows Store to stop working.
+  This policy applies only when this PC is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\DoNotConnectToWindowsUpdateInternetLocations"
+  AND Registry.registry_value_data="0x00000001" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_do_not_connect_to_win_update_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
new file mode 100644
index 0000000000..9b7e4b9b6c
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry No Auto Reboot With Logon User
+id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will allow "Logged-on user gets to choose whether or not to restart his or her compute".
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoRebootWithLoggedOnUsers"
+  AND Registry.registry_value_data="0x00000001" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_no_auto_reboot_with_logon_user_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 9
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml
new file mode 100644
index 0000000000..34d5e55e59
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry No Auto Update
+id: fbd4f333-17bb-4eab-89cb-860fa2e0600e
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will "Disable Automatic Updates".
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate"
+  AND Registry.registry_value_data="0x00000001" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_no_auto_update_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml
new file mode 100644
index 0000000000..c96f40159a
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml
@@ -0,0 +1,64 @@
+name: 'Windows Modify Registry Tamper Protection'
+id: 12094335-88fc-4c3a-b55f-e62dd8c93c23
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification to tamper Windows Defender protection. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. 
+  RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection"
+  AND Registry.registry_value_data="0x00000000" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_tamper_protection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: a registry modification to tamper Windows Defender protection in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

From fc1263afd8d7ff26b66b42cf3a48479ca630f2f1 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 27 Apr 2023 16:08:45 +0200
Subject: [PATCH 02/15] do_not_step_on_the_redline2

---
 ...ows_modify_registry_auto_minor_updates.yml | 66 +++++++++++++++++++
 ...ify_registry_updateserviceurlalternate.yml | 65 ++++++++++++++++++
 .../windows_modify_registry_usewuserver.yml   | 66 +++++++++++++++++++
 .../windows_modify_registry_wuserver.yml      | 66 +++++++++++++++++++
 ...windows_modify_registry_wustatusserver.yml | 66 +++++++++++++++++++
 5 files changed, 329 insertions(+)
 create mode 100644 detections/endpoint/windows_modify_registry_auto_minor_updates.yml
 create mode 100644 detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
 create mode 100644 detections/endpoint/windows_modify_registry_usewuserver.yml
 create mode 100644 detections/endpoint/windows_modify_registry_wuserver.yml
 create mode 100644 detections/endpoint/windows_modify_registry_wustatusserver.yml

diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
new file mode 100644
index 0000000000..47b2c98444
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry Auto Minor Updates
+id: be498b9f-d804-4bbf-9fc0-d5448466b313
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will "Treat minor updates like other updates".
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\AutoInstallMinorUpdates"
+  AND Registry.registry_value_data="0x00000000" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_auto_minor_updates_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 30
+  impact: 30
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 9
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
new file mode 100644
index 0000000000..6e348f3734
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
@@ -0,0 +1,65 @@
+name: Windows Modify Registry UpdateServiceUrlAlternate
+id: ca4e94fb-7969-4d63-8630-3625809a1f70
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that specifies an intranet server to host updates from Microsoft Update.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\UpdateServiceUrlAlternate"
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_updateserviceurlalternate_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml
new file mode 100644
index 0000000000..b8d157fb81
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_usewuserver.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry USeWuServer
+id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification that will use "The WUServer value unless this key is set".
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\UseWUServer"
+  AND Registry.registry_value_data="0x00000001" 
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_usewuserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml
new file mode 100644
index 0000000000..80ef67f74d
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_wuserver.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry WuServer
+id: a02ad386-e26d-44ce-aa97-6a46cee31439
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification related to the WSUS server used by Automatic Updates and (by default) API callers. 
+  This policy is paired with WUStatusServer; both must be set to the same value in order for them to be valid.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUServer"
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_wuserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml
new file mode 100644
index 0000000000..ed97885ff6
--- /dev/null
+++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml
@@ -0,0 +1,66 @@
+name: Windows Modify Registry wuStatusServer
+id: 073e69d0-68b2-4142-aa90-a7ee6f590676
+version: 1
+date: '2023-04-21'
+author: Teoderick Contreras, Splunk
+status: production
+type: Hunting
+data_source:
+- Sysmon EventID 12, 13, 14
+description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
+  This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
+  to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
+  RedLine Stealer is one of the malware we've seen that uses this technique to evade detection and add more payload on the target host.
+  This detection looks for registry modification related to the server to which reporting information will be sent for client computers 
+  that use the WSUS server configured by the WUServer key. This policy is paired with WUServer; both must be set to the same value in order for them to be valid.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path="*\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\WUStatusServer"
+  by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_key_name 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_modify_registry_wustatusserver_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: administrators may enable or disable this feature that may
+  cause some false positive.
+references:
+- https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
+tags:
+  analytic_story:
+  - RedLine Stealer
+  asset_type: Endpoint
+  confidence: 50
+  impact: 50
+  message: a registry modification in Windows auto update configuration in $dest$
+  mitre_attack_id:
+  - T1112
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Registry.action
+  - Registry.registry_value_data
+  risk_score: 25
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 068537e8c64e26b13cb9f71802b42a2e7f9b366f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 1 May 2023 23:56:33 +0000
Subject: [PATCH 03/15] Bump psutil from 5.9.4 to 5.9.5

Bumps [psutil](https://github.com/giampaolo/psutil) from 5.9.4 to 5.9.5.
- [Release notes](https://github.com/giampaolo/psutil/releases)
- [Changelog](https://github.com/giampaolo/psutil/blob/master/HISTORY.rst)
- [Commits](https://github.com/giampaolo/psutil/compare/release-5.9.4...release-5.9.5)

---
updated-dependencies:
- dependency-name: psutil
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 3ba80ab587..8188461b1c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@ GitPython==3.1.31
 Jinja2==3.1.2
 jsonschema==4.17.3
 mock==4.0.3
-psutil==5.9.4
+psutil==5.9.5
 pycvesearch==1.2
 pydantic==1.10.7
 pysigma==0.9.4

From 16d9cedd611d3ea094e4232bc5fc26a51e2882f0 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:08:12 +0200
Subject: [PATCH 04/15] Update windows_modify_registry_auto_minor_updates.yml

---
 .../endpoint/windows_modify_registry_auto_minor_updates.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
index 47b2c98444..36d75e0a20 100644
--- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From c7a2b8ed83f611f57649367b93617326d9165823 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:08:25 +0200
Subject: [PATCH 05/15] Update windows_modify_registry_auto_update_notif.yml

---
 .../endpoint/windows_modify_registry_auto_update_notif.yml  | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
index a37db5d23d..accbfbb79d 100644
--- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml
+++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update notification. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 68ea027be0415b026655f5176282a21cb88caf55 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:08:42 +0200
Subject: [PATCH 06/15] Update
 windows_modify_registry_disable_windefender_notifications.yml

---
 ...ws_modify_registry_disable_windefender_notifications.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
index c3a55322c1..edac65e849 100644
--- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: TTP
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification to disable Windows Defender notification. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. 
   RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection.
@@ -61,4 +63,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 7ef1f17a37b4661bb025682d0c808e1194497fe3 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:08:55 +0200
Subject: [PATCH 07/15] Update
 windows_modify_registry_do_not_connect_to_win_update.yml

---
 ...windows_modify_registry_do_not_connect_to_win_update.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
index 66c6cc97d7..e7626c0387 100644
--- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
+++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -65,4 +67,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 0f15ab5c98cb4e9b1cdd3ce3968b9bdec6cff5ca Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:09:09 +0200
Subject: [PATCH 08/15] Update
 windows_modify_registry_no_auto_reboot_with_logon_user.yml

---
 ...ndows_modify_registry_no_auto_reboot_with_logon_user.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
index 9b7e4b9b6c..be375ad274 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 0c37784e515275fef5133a362b1225eda7253542 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:09:22 +0200
Subject: [PATCH 09/15] Update windows_modify_registry_no_auto_update.yml

---
 .../endpoint/windows_modify_registry_no_auto_update.yml     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml
index 34d5e55e59..0df0433a99 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_update.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 966cd572c796fab822c02f16cd59c540d0c8591a Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:09:38 +0200
Subject: [PATCH 10/15] Update windows_modify_registry_tamper_protection.yml

---
 .../endpoint/windows_modify_registry_tamper_protection.yml    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml
index c96f40159a..0374e21473 100644
--- a/detections/endpoint/windows_modify_registry_tamper_protection.yml
+++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: TTP
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification to tamper Windows Defender protection. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to evade detection on the targeted machine. 
   RedLine Stealer is one of the malware we've seen that uses this technique to bypass Windows defender detection.

From d760588b77dd115fff077e5b6154f30678103b43 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:09:53 +0200
Subject: [PATCH 11/15] Update windows_modify_registry_wustatusserver.yml

---
 .../endpoint/windows_modify_registry_wustatusserver.yml     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml
index ed97885ff6..9c8a7a9ada 100644
--- a/detections/endpoint/windows_modify_registry_wustatusserver.yml
+++ b/detections/endpoint/windows_modify_registry_wustatusserver.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 7daea0121a9aa48367d967728b2f56bcc99f1066 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:10:10 +0200
Subject: [PATCH 12/15] Update windows_modify_registry_wuserver.yml

---
 detections/endpoint/windows_modify_registry_wuserver.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml
index 80ef67f74d..f84b682583 100644
--- a/detections/endpoint/windows_modify_registry_wuserver.yml
+++ b/detections/endpoint/windows_modify_registry_wuserver.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From d64f9d3a6e4f8d1751fa1f5aea0cb48649cfd256 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:10:27 +0200
Subject: [PATCH 13/15] Update windows_modify_registry_usewuserver.yml

---
 detections/endpoint/windows_modify_registry_usewuserver.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml
index b8d157fb81..05d38144d8 100644
--- a/detections/endpoint/windows_modify_registry_usewuserver.yml
+++ b/detections/endpoint/windows_modify_registry_usewuserver.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From 013067bab4d9b52db456404f9b469fa2e942e335 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:11:08 +0200
Subject: [PATCH 14/15] Update
 windows_modify_registry_updateserviceurlalternate.yml

---
 .../windows_modify_registry_updateserviceurlalternate.yml   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
index 6e348f3734..8926481922 100644
--- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
+++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -62,4 +64,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog

From e985d2207ddf6d218c05c20dbf34a4aeb1a165e6 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 2 May 2023 12:45:47 -0700
Subject: [PATCH 15/15] minor fixes

---
 .../endpoint/windows_modify_registry_auto_minor_updates.yml | 2 +-
 .../endpoint/windows_modify_registry_auto_update_notif.yml  | 2 +-
 ...ws_modify_registry_disable_windefender_notifications.yml | 2 +-
 ...ndows_modify_registry_no_auto_reboot_with_logon_user.yml | 4 ++--
 .../endpoint/windows_modify_registry_no_auto_update.yml     | 4 ++--
 .../endpoint/windows_modify_registry_tamper_protection.yml  | 6 +++---
 .../windows_modify_registry_updateserviceurlalternate.yml   | 4 ++--
 detections/endpoint/windows_modify_registry_wuserver.yml    | 4 ++--
 8 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
index 36d75e0a20..92ad1fea19 100644
--- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: a registry modification in Windows auto update configuration in $dest$
+  message: A registry modification in Windows auto update configuration on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
index accbfbb79d..f9895cc7a6 100644
--- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml
+++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: a registry modification in Windows auto update notification in $dest$
+  message: A registry modification in Windows auto update notification on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
index edac65e849..0f8ea8a05d 100644
--- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
+++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
@@ -35,7 +35,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: a registry modification to disable Windows Defender notification in $dest$
+  message: A registry modification to disable Windows Defender notification on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
index be375ad274..acc6dd1b97 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
@@ -27,7 +27,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: administrators may enable or disable this feature that may
+known_false_positives: Administrators may enable or disable this feature that may
   cause some false positive.
 references:
 - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: a registry modification in Windows auto update configuration in $dest$
+  message: A registry modification in Windows auto update configuration on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml
index 0df0433a99..6f2e7be2b1 100644
--- a/detections/endpoint/windows_modify_registry_no_auto_update.yml
+++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml
@@ -27,7 +27,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: administrators may enable or disable this feature that may
+known_false_positives: Administrators may enable or disable this feature that may
   cause some false positive.
 references:
 - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: a registry modification in Windows auto update configuration in $dest$
+  message: A registry modification in Windows auto update configuration on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml
index 0374e21473..058432a56e 100644
--- a/detections/endpoint/windows_modify_registry_tamper_protection.yml
+++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml
@@ -1,4 +1,4 @@
-name: 'Windows Modify Registry Tamper Protection'
+name: Windows Modify Registry Tamper Protection
 id: 12094335-88fc-4c3a-b55f-e62dd8c93c23
 version: 1
 date: '2023-04-21'
@@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: administrators may enable or disable this feature that may
+known_false_positives: Administrators may enable or disable this feature that may
   cause some false positive.
 references:
 - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
@@ -35,7 +35,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: a registry modification to tamper Windows Defender protection in $dest$
+  message: A registry modification to tamper Windows Defender protection on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
index 8926481922..010600b1d3 100644
--- a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
+++ b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
@@ -26,7 +26,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: administrators may enable or disable this feature that may
+known_false_positives: Administrators may enable or disable this feature that may
   cause some false positive.
 references:
 - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
@@ -36,7 +36,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: a registry modification in Windows auto update configuration in $dest$
+  message: A registry modification in Windows auto update configuration on $dest$
   mitre_attack_id:
   - T1112
   observable:
diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml
index f84b682583..91a9851d93 100644
--- a/detections/endpoint/windows_modify_registry_wuserver.yml
+++ b/detections/endpoint/windows_modify_registry_wuserver.yml
@@ -27,7 +27,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: administrators may enable or disable this feature that may
+known_false_positives: Administrators may enable or disable this feature that may
   cause some false positive.
 references:
 - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 50
   impact: 50
-  message: a registry modification in Windows auto update configuration in $dest$
+  message: A registry modification in Windows auto update configuration on $dest$
   mitre_attack_id:
   - T1112
   observable: