splunk-security_content/detections/endpoint/windows_disable_shutdown_button_through_registry.yml

name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: This analytic is to detect a suspicious registry modification to disable
  shutdown button on the logon user. This technique was seen in several malware especially
  in ransomware family like killdisk malware variant to make the compromised host
  un-useful and hard to remove other registry modification made on the machine that
  needs restart to take effect. This windows feature may implement by administrator
  in some server where shutdown is critical. In that scenario filter of machine and
  users that can modify this registry is needed.
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
  Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
  Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user
  Registry.registry_path Registry.registry_value_name Registry.registry_value_data
  Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name
  Processes.process Processes.dest Processes.parent_process_name Processes.parent_process
  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
  proc_guid | fields _time dest user parent_process_name parent_process process_name
  process_path process proc_guid registry_path registry_value_name registry_value_data]
  | table _time dest user parent_process_name parent_process process_name process_path
  process proc_guid registry_path registry_value_name registry_value_data | `windows_disable_shutdown_button_through_registry_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the Filesystem responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
known_false_positives: This windows feature may implement by administrator in some
  server where shutdown is critical. In that scenario filter of machine and users
  that can modify this registry is needed.
references:
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/
tags:
  analytic_story:
  - Ransomware
  - Windows Registry Abuse
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1112
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Registry.registry_key_name
  - Registry.registry_path
  - Registry.registry_value_name
  - Registry.dest Registry.user
  - Processes.process_id
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.process_guid
  security_domain: endpoint
  impact: 70
  confidence: 70
  risk_score: 49
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
  message: Registry modification in "shutdownwithoutlogon" on $dest$
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  nist:
  - DE.CM
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  asset_type: Endpoint
  supported_tas:
  - Splunk_TA_microsoft_sysmon