mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research-bot
67 lines
4.0 KiB
YAML
67 lines
4.0 KiB
YAML
name: Disabling FolderOptions Windows Feature
|
|
id: 83776de4-921a-11eb-868a-acde48001122
|
|
version: 7
|
|
date: '2024-09-30'
|
|
author: Steven Dick, Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" with a value of "0x00000001". This activity is significant as it is commonly used by malware to conceal malicious files and deceive users with fake file extensions. If confirmed malicious, this could allow an attacker to hide their presence and malicious files, making detection and remediation more difficult.
|
|
data_source:
|
|
- Sysmon EventID 12
|
|
- Sysmon EventID 13
|
|
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_data = "0x00000001") BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical Sysmon TA. https://splunkbase.splunk.com/app/5709
|
|
known_false_positives: admin may disable this application for non technical user.
|
|
references:
|
|
- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$user$" and "$dest$"
|
|
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
tags:
|
|
analytic_story:
|
|
- Windows Defense Evasion Tactics
|
|
- CISA AA23-347A
|
|
- Windows Registry Abuse
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 50
|
|
message: The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
|
|
mitre_attack_id:
|
|
- T1562.001
|
|
- T1562
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Registry.dest
|
|
- Registry.registry_value_name
|
|
- Registry.registry_key_name
|
|
- Registry.registry_path
|
|
- Registry.registry_value_data
|
|
- Registry.process_guid
|
|
risk_score: 25
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|