mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
88 lines
3.9 KiB
JSON
88 lines
3.9 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, user, registry_path",
|
|
"rule_description": "A registry key that is used for persistence on Windows was modified on $dest$ by $src_user$.",
|
|
"rule_title": "Registry Key Associated With Persistence Modified on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 30
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,user,registry_path",
|
|
"suppress_period": "14400s"
|
|
}
|
|
},
|
|
"creation_date": "2017-08-23",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Endpoint"
|
|
],
|
|
"data_source": [
|
|
"Endpoint Intel"
|
|
],
|
|
"providing_technologies": [
|
|
"Carbon Black Response",
|
|
"CrowdStrike Falcon",
|
|
"Sysmon"
|
|
]
|
|
},
|
|
"eli5": "This search looks for specific registry paths that malware often uses to ensure survivability and persistence on system startup. The search returns the count, the first time the activity was seen, the last time the activity was seen, the registry path that was modified, the host where the modification took place and the user that performed the modification.",
|
|
"how_to_implement": "To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response products, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.",
|
|
"known_false_positives": "There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 8"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Persistence",
|
|
"Registry Run Keys / Start Folder",
|
|
"AppInit DLLs",
|
|
"Authentication Package"
|
|
],
|
|
"nist": [
|
|
"PR.PT",
|
|
"DE.CM",
|
|
"DE.AE"
|
|
]
|
|
},
|
|
"modification_date": "2017-10-10",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\\\run* OR Registry.registry_path=*currentVersion\\\\Windows\\\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\\\Winlogon\\\\Shell* OR Registry.registry_path=*CurrentVersion\\\\Winlogon\\\\Userinit* OR Registry.registry_path=*CurrentVersion\\\\Winlogon\\\\VmApplet* OR Registry.registry_path=*currentversion\\\\policies\\\\explorer\\\\run* OR Registry.registry_path=*currentversion\\\\runservices* OR Registry.registry_path=*\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\* OR Registry.registry_path=\"*Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options*\" OR Registry.registry_path=HKLM\\\\SOFTWARE\\\\Microsoft\\\\Netsh\\\\*) by Registry.dest , Registry.status, Registry.user | `ctime(lastTime)` | `ctime(firstTime)` | `drop_dm_object_name(Registry)`",
|
|
"search_description": "The search looks for modifications to registry keys that can be used to launch an application or service at system startup.",
|
|
"search_id": "f5f6af30-7aa7-4295-bfe9-07fe87c01a4b",
|
|
"search_name": "Registry Keys Used For Persistence",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "3.0"
|
|
}
|