fix(rule): Improve Hidden local account creation rule

The condition is modified to consider both, RegCreateKey and RegSetValue events. The registry key path trailing backslashes are removed because in case of RegCreateKey events, the registry key is reported without ending backslashes.

Author: rabbitstack

rules/macros/macros.yml

@@ -50,7 +50,7 @@
   expr: kevt.name = 'RegCreateKey' and registry.status = 'Success'
 
 - macro: modify_registry
-  expr: (set_value or create_key)
+  expr: ((set_value) or (create_key))
 
 - macro: send_socket
   expr: kevt.name = 'Send'

rules/persistence_hidden_local_account_creation.yml

@@ -17,10 +17,10 @@ labels:
   subtechnique.ref: https://attack.mitre.org/techniques/T1136/001/
 
 condition: >
-  set_value and registry.path imatches 
+  modify_registry and registry.path imatches 
     (
-      'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\',
-      'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\*$\\'
+      'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$',
+      'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\*$'
     )
 
 severity: high