splunk-security_content/detections/deprecated/remote_registry_key_modifications.yml

name: Remote Registry Key modifications
id: c9f4b923-f8af-4155-b697-1354f5dcbc5e
version: 3
date: '2020-03-02'
author: Bhavin Patel, Splunk
type: TTP
datamodel: []
description: This search monitors for remote modifications to registry keys.
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
  as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where  Registry.registry_path="\\\\*"  by
  Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  | `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter`'
how_to_implement: To successfully implement this search, you must populate the `Endpoint`
  data model. This is typically populated via endpoint detection-and-response product,
  such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for
  this search is typically generated via logs that report reads and writes to the
  registry. Deprecated because I don't think the logic is right.
known_false_positives: This technique may be legitimately used by administrators to
  modify remote registries, so it's important to filter these events out.
references: []
tags:
  analytic_story:
  - Windows Defense Evasion Tactics
  - Suspicious Windows Registry Activities
  - Windows Persistence Techniques
  asset_type: Endpoint
  cis20:
  - CIS 8
  kill_chain_phases:
  - Actions on Objectives
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: endpoint
  confidence: 50
  impact: 50
  risk_score: 25
  context:
  - Unknown
  message: tbd
  observable:
  - name: field
    type: Unknown
    role:
    - Unknown