name: Windows DisableAntiSpyware Registry
id: 23150a40-9301-4195-b802-5bb4f43067fb
version: 2
date: '2021-03-02'
author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
status: production
type: TTP
description: The search looks for the Registry Key DisableAntiSpyware set to disable.
  This is consistent with Ryuk infections across a fleet of endpoints. This particular
  behavior is typically executed when an ransomware actor gains access to an endpoint
  and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
  registry and scheduled task modifications will occur. During triage, review parallel
  processes and identify any further file modifications. Endpoint should be isolated.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Details: '0x00000001'
    Registry.registry_value_name: DisableAntiSpyware
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node.
known_false_positives: It is unusual to turn this feature off a Windows system since
  it is a default security control, although it is not rare for some policies to disable
  it. Although no false positives have been identified, use the provided filter macro
  to tune the search.
references:
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
tags:
  analytic_story:
  - Ryuk Ransomware
  - Windows Defense Evasion Tactics
  - Windows Registry Abuse
  - Azorult
  - CISA AA22-264A
  asset_type: Endpoint
  confidence: 80
  impact: 30
  message: Windows DisableAntiSpyware registry key set to 'disabled' on $dest$
  mitre_attack_id:
  - T1562.001
  - T1562
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 24
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog