splunk-security_content/docs/_stories/windows_persistence_techniques.md

title, last_modified_at, toc, tags

title	last_modified_at	toc	tags
Windows Persistence Techniques	2018-05-31	true	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Description

Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.

• ID: 30874d4f-20a1-488f-85ec-5d52ef74e3f9
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2018-05-31
• Author: Bhavin Patel, Splunk

Detection profiles

Name	Technique	Type
Certutil exe certificate extraction	None	TTP
Detect Path Interception By Creation Of program exe	None	TTP
Hiding Files And Directories With Attrib exe	None	TTP
Illegal Account Creation via PowerSploit modules	None	TTP
Illegal Enabling or Disabling of Accounts via DSInternals modules	None	TTP
Illegal Management of Active Directory Elements and Policies via DSInternals modules	None	TTP
Illegal Management of Computers and Active Directory Elements via PowerSploit modules	None	TTP
Illegal Privilege Elevation and Persistence via PowerSploit modules	None	TTP
Monitor Registry Keys for Print Monitors	None	TTP
Reg exe Manipulating Windows Services Registry Keys	None	TTP
Registry Keys Used For Persistence	None	TTP
Registry Keys for Creating SHIM Databases	None	TTP
Sc exe Manipulating Windows Services	None	TTP
Schedule Task with HTTP Command Arguments	None	TTP
Schedule Task with Rundll32 Command Trigger	None	TTP
Schtasks used for forcing a reboot	None	TTP
Setting Credentials via DSInternals modules	None	TTP
Setting Credentials via Mimikatz modules	None	TTP
Setting Credentials via PowerSploit modules	None	TTP
Shim Database File Creation	None	TTP
Shim Database Installation With Suspicious Parameters	None	TTP
Suspicious Scheduled Task from Public Directory	None	Anomaly
WinEvent Scheduled Task Created Within Public Path	None	TTP
WinEvent Scheduled Task Created to Spawn Shell	None	TTP

Reference

• http://www.fuzzysecurity.com/tutorials/19.html
• https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
• http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/
• https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
• https://www.youtube.com/watch?v=dq2Hv7J9fvk

source | version: 2