admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inRevil Registry Entry

Browse Source
This commit is contained in:
root
2021-06-07 08:24:20 +00:00
parent 89a202914c
commit eef40d3a65
1 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/revil_registry_entry.yml
+15 -14
View File
@@ -6,22 +6,20 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection.
This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated
file extension it uses for all the encrypted files and ransomware notes file name in the compromised host.
description: This analytic identifies suspicious modification in registry entry to
keep some malware data during its infection. This technique seen in several apt
implant, malware and ransomware like REVIL where it keep some information like the
random generated file extension it uses for all the encrypted files and ransomware
notes file name in the compromised host.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data")
by Registry.registry_value_name Registry.dest Registry.user
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)`
| `revil_registry_entry_filter`'
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary
Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`'
how_to_implement: to successfully implement this search, you need to be ingesting
logs with the Image, TargetObject registry key, registry Details from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
logs with the Image, TargetObject registry key, registry Details from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: unknown
references:
- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
@@ -45,4 +43,7 @@ tags:
- Registry.registry_value_name
- Registry.registry_path
- Registry.registry_key_name
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log