mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
34 lines
1.6 KiB
YAML
34 lines
1.6 KiB
YAML
name: Get Registry Activities
|
|
id: fecf2918-670d-4f1c-872b-3d7317a41xf9
|
|
version: 2
|
|
date: '2019-03-01'
|
|
description: This search queries the Endpoint Datamodel to give you details of the
|
|
latest registry values for a specific destination computer.
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on registry changes that include the name of the process responsible for the changes
|
|
from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry`
|
|
nodes.
|
|
author: Bhavin Patel, Splunk
|
|
inputs:
|
|
- dest
|
|
search: '| tstats `security_content_summariesonly` values(Registry.registry_path)
|
|
as registry_path values(Registry.registry_key_name) as registry_key_name count FROM
|
|
datamodel=Endpoint.Registry where Registry.dest = "$dest$" by Registry.process_id
|
|
Registry.dest | `drop_dm_object_name("Registry")` | join [| tstats `security_content_summariesonly`
|
|
count values(Processes.user) as user values(Processes.process_name) as process_name
|
|
values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes
|
|
where Processes.process_name = reg.exe by Processes.process_id | `drop_dm_object_name("Processes")`]'
|
|
tags:
|
|
analytics_story:
|
|
- DHS Report TA18-074A
|
|
- 'Emotet Malware DHS Report TA18-201A '
|
|
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
|
|
- Ransomware
|
|
- Suspicious Command-Line Executions
|
|
- Suspicious MSHTA Activity
|
|
- Suspicious Windows Registry Activities
|
|
- Windows Defense Evasion Tactics
|
|
- Windows File Extension and Association Abuse
|
|
- Windows Persistence Techniques
|
|
- Windows Privilege Escalation
|