mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
35 lines
1.5 KiB
YAML
35 lines
1.5 KiB
YAML
name: Remote Registry Key modifications
|
|
id: c9f4b923-f8af-4155-b697-1354f5dcbc5e
|
|
version: 3
|
|
date: '2020-03-02'
|
|
description: This search monitors for remote modifications to registry keys.
|
|
how_to_implement: To successfully implement this search, you must populate the `Endpoint`
|
|
data model. This is typically populated via endpoint detection-and-response products,
|
|
such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for
|
|
this search is typically generated via logs that report reads and writes to the
|
|
registry.
|
|
type: ESCU
|
|
references: []
|
|
author: Bhavin Patel, Splunk
|
|
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
|
|
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
|
|
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by
|
|
Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
|
|
| `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter`'
|
|
known_false_positives: This technique may be legitimately used by administrators to
|
|
modify remote registries, so it's important to filter these events out.
|
|
tags:
|
|
analytics_story:
|
|
- Windows Defense Evasion Tactics
|
|
- Suspicious Windows Registry Activities
|
|
- Windows Persistence Techniques
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 8
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|