From eef40d3a65ce22b5f0daec37bbf855d032b83441 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 7 Jun 2021 08:24:20 +0000 Subject: [PATCH] Added detection testing service results inRevil Registry Entry --- detections/endpoint/revil_registry_entry.yml | 29 ++++++++++---------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 1072f2684c..025747e416 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -6,22 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. - This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the random generated - file extension it uses for all the encrypted files and ransomware notes file name in the compromised host. +description: This analytic identifies suspicious modification in registry entry to + keep some malware data during its infection. This technique seen in several apt + implant, malware and ransomware like REVIL where it keep some information like the + random generated file extension it uses for all the encrypted files and ransomware + notes file name in the compromised host. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" - AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary Data") - by Registry.registry_value_name Registry.dest Registry.user - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `revil_registry_entry_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*" + AND (Registry.registry_value_name = "\.*" OR Registry.registry_value_name = "Binary + Data") by Registry.registry_value_name Registry.dest Registry.user | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `revil_registry_entry_filter`' how_to_implement: to successfully implement this search, you need to be ingesting - logs with the Image, TargetObject registry key, registry Details from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + logs with the Image, TargetObject registry key, registry Details from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/ @@ -45,4 +43,7 @@ tags: - Registry.registry_value_name - Registry.registry_path - Registry.registry_key_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log