diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index fbdde9ba2c..3b22664a52 100644 --- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,7 +1,7 @@ name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 5 -date: '2020-07-21' +version: 6 +date: '2020-11-06' description: Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. how_to_implement: You must be ingesting data that records process activity from your @@ -11,13 +11,12 @@ how_to_implement: You must be ingesting data that records process activity from type: ESCU references: [] author: Patrick Bareiss, Splunk -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ - \ as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\\ - \\Microsoft\\\\Powershell\\\\1\\\\ShellIds\\\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy\ - \ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\ - \ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\ - \ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\ - \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_" +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\\\Microsoft\\\\Powershell\\\\1\\\\ShellIds\\\\Microsoft.PowerShell* + Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) + by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`" known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should diff --git a/tests/endpoint/attempt_to_stop_security_service.test.yml b/tests/endpoint/attempt_to_stop_security_service.test.yml new file mode 100644 index 0000000000..a9bb26fb54 --- /dev/null +++ b/tests/endpoint/attempt_to_stop_security_service.test.yml @@ -0,0 +1,10 @@ +name: Attempt To Stop Security Service Unit Test +detections: +- name: Attempt To Stop Security Service + file: endpoint/attempt_to_stop_security_service.yml + pass_condition: '| stats count | where count > 0' +attack_data: +- file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001_custom_f3b70c45-3f9f-493d-b0b0-6be2ad9f158b/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog