Skip to content

Commit a91c2aa

Browse files
nasbenchnasbench
committed
Fix incorrect data sources
1 parent d985dc1 commit a91c2aa

8 files changed

+19
-27
lines changed

‎detections/endpoint/detect_remote_access_software_usage_registry.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Registry
22
id: 33804986-25dd-43cf-bb6b-dc14956c7cbc
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-06-10'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -11,7 +11,6 @@ description: The following analytic detects when a known remote access software
1111
in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review
1212
the lookup for the entire list and add any others.
1313
data_source:
14-
- Sysmon EventID 12
1514
- Sysmon EventID 13
1615
search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as
1716
process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry

‎detections/endpoint/disable_defender_enhanced_notification.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Disable Defender Enhanced Notification
22
id: dc65678c-301f-11ec-8e30-acde48001122
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-06-10'
55
author: Teoderick Contreras, Splunk, Steven Dick
66
status: production
77
type: TTP
@@ -15,7 +15,6 @@ description: The following analytic detects the modification of the registry to
1515
mechanisms, maintain persistence, and escalate their activities without triggering
1616
alerts.
1717
data_source:
18-
- Sysmon EventID 12
1918
- Sysmon EventID 13
2019
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
2120
WHERE (Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name

‎detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
22
id: c2590137-0b08-4985-9ec5-6ae23d92f63d
3-
version: 16
4-
date: '2025-05-02'
3+
version: 17
4+
date: '2025-06-10'
55
author: Steven Dick, Patrick Bareiss, Splunk
66
status: production
77
type: TTP
@@ -13,7 +13,6 @@ description: The following analytic detects changes to the PowerShell ExecutionP
1313
confirmed malicious, this could enable an attacker to execute arbitrary code, leading
1414
to further compromise of the system and potential escalation of privileges.
1515
data_source:
16-
- Sysmon EventID 12
1716
- Sysmon EventID 13
1817
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
1918
WHERE (Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*

‎detections/endpoint/silentcleanup_uac_bypass.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: SilentCleanup UAC Bypass
22
id: 56d7cfcc-da63-11eb-92d4-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-06-10'
55
author: Steven Dick, Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -14,7 +14,6 @@ description: The following analytic detects suspicious modifications to the regi
1414
this could lead to unauthorized administrative access, enabling further system compromise
1515
and persistence.
1616
data_source:
17-
- Sysmon EventID 12
1817
- Sysmon EventID 13
1918
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
2019
WHERE (Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data

‎detections/endpoint/windows_ad_dsrm_account_changes.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
name: Windows AD DSRM Account Changes
22
id: 08cb291e-ea77-48e8-a95a-0799319bf056
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-06-10'
55
author: Dean Luxton
66
type: TTP
77
status: production
88
data_source:
9-
- Sysmon EventID 12
109
- Sysmon EventID 13
1110
description: The following analytic identifies changes to the Directory Services Restore
1211
Mode (DSRM) account behavior via registry modifications. It detects alterations

‎detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Modify Registry Qakbot Binary Data Registry
22
id: 2e768497-04e0-4188-b800-70dd2be0e30d
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-06-10'
55
author: Teoderick Contreras, Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
@@ -15,7 +15,6 @@ description:
1515
data. If confirmed malicious, this could allow attackers to maintain persistence
1616
and execute arbitrary code on the compromised system.
1717
data_source:
18-
- Sysmon EventID 1 AND Sysmon EventID 12
1918
- Sysmon EventID 1 AND Sysmon EventID 13
2019
search:
2120
'| tstats `security_content_summariesonly` count dc(registry_value_name) as

‎detections/endpoint/windows_process_executed_from_removable_media.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows Process Executed From Removable Media
22
id: b483804a-4cc0-49a4-9f00-ac29ba844d08
3-
version: 4
4-
date: '2025-05-02'
3+
version: 5
4+
date: '2025-06-10'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -11,7 +11,6 @@ description: This analytic is used to identify when a removable media device is
1111
media devices for several malicious activities, including initial access, execution,
1212
and exfiltration.
1313
data_source:
14-
- Sysmon EventID 1 AND Sysmon EventID 12
1514
- Sysmon EventID 1 AND Sysmon EventID 13
1615
search: "| tstats `security_content_summariesonly` count values(Processes.process)\
1716
\ as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes\

‎detections/endpoint/windows_runmru_command_execution.yml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
11
name: Windows RunMRU Command Execution
22
id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a
3-
version: 7
4-
date: '2025-05-14'
3+
version: 8
4+
date: '2025-06-10'
55
author: Nasreddine Bencherchali, Michael Haag, Splunk
6-
data_source:
7-
- Sysmon EventID 12
8-
- Sysmon EventID 13
9-
type: Anomaly
106
status: production
7+
type: Anomaly
118
description: The following analytic detects modifications to the Windows RunMRU registry
129
key, which stores a history of commands executed through the Run dialog box (Windows+R).
1310
It leverages Endpoint Detection and Response (EDR) telemetry to monitor registry
@@ -16,6 +13,8 @@ description: The following analytic detects modifications to the Windows RunMRU
1613
If confirmed malicious, this could indicate an attacker using indirect command execution
1714
techniques for defense evasion or persistence. The detection excludes MRUList value
1815
changes to focus on actual command entries.
16+
data_source:
17+
- Sysmon EventID 13
1918
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" NOT Registry.registry_value_name="MRUList" NOT Registry.registry_value_data="unknown" by Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_hive Registry.registry_value_name Registry.status Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_runmru_command_execution_filter`'
2019
how_to_implement: The detection is based on data that originates from Endpoint Detection
2120
and Response (EDR) agents. These agents are designed to provide security-related

0 commit comments

Comments
 (0)