splunk-security_content/detections/endpoint/malicious_inprocserver32_modification.yml

name: Malicious InProcServer32 Modification
id: 127c8d08-25ff-11ec-9223-acde48001122
version: 1
date: '2021-10-05'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies a process modifying the registry with
  a known malicious CLSID under InProcServer32. Most COM classes are registered with
  the operating system and are identified by a GUID that represents the Class Identifier
  (CLSID) within the registry (usually under HKLM\\Software\\Classes\\CLSID or HKCU\\Software\\Classes\\CLSID).  Behind
  the implementation of a COM class is the server (some binary) that is referenced
  within registry keys under the CLSID.  The LocalServer32 key represents a path to
  an executable (exe) implementation, and the InprocServer32 key represents a path
  to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel
  processes for suspicious activity. Pivot on the process GUID to see the full timeline
  of events. Analyze the value and look for file modifications. Being this is looking
  for inprocserver32, a DLL found in the value will most likely be loaded by a parallel
  process.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
  Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
  `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path=
  "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by
  Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest
  Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` | fields _time
  dest registry_path registry_key_name registry_value_name process_name process_path
  process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime
  by dest, process_name registry_path registry_key_name registry_value_name user |
  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives should be limited, filter as needed. In our
  test case, Remcos used regsvr32.exe to modify the registry. It may be required,
  dependent upon the EDR tool producing registry events, to remove (Default) from
  the command-line.
references:
- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
- https://tria.ge/210929-ap75vsddan
- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
tags:
  analytic_story:
  - Suspicious Regsvr32 Activity
  - Remcos
  confidence: 100
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
  impact: 80
  kill_chain_phases:
  - Exploitation
  message: The $process_name$ was identified on endpoint $dest$ modifying the registry
    with a known malicious clsid under InProcServer32.
  mitre_attack_id:
  - T1218.010
  - T1112
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - dest
  - process_name
  - registry_path
  - registry_key_name
  - registry_value_name
  - user
  risk_score: 80
  security_domain: endpoint
  asset_type: Endpoint