Skip to content

Commit bb6f8b8

Browse files
pyth0n1cpyth0n1c
authored
Merge pull request #3624 from splunk/sysmon_5_detection_fixes
Update detections for Sysmon TA- 5.0.0
2 parents ea56997 + 919f2fd commit bb6f8b8

4 files changed

+17
-17
lines changed

‎detections/endpoint/remcos_client_registry_install_entry.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Remcos client registry install entry
22
id: f2a1615a-1d63-11ec-97d2-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-07-30'
55
author: Steven Dick, Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -19,7 +19,7 @@ data_source:
1919
- Sysmon EventID 13
2020
search:
2121
'| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
22-
WHERE (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.action Registry.dest
22+
WHERE (Registry.registry_path=*\\Software\\Remcos*) by Registry.action Registry.dest
2323
Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
2424
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
2525
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product

‎detections/endpoint/windows_audit_policy_auditing_option_modified___registry.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
name: Windows Audit Policy Auditing Option Modified - Registry
22
id: 27914692-9c62-44ea-9129-ceb429b61bd0
3-
version: 3
4-
date: '2025-05-02'
5-
author: Nasreddine Bencherchali, Splunk
3+
version: 4
4+
date: '2025-07-30'
5+
author: Nasreddine Bencherchali, Bhavin Patel, Splunk
66
status: production
77
type: Anomaly
88
description: The following analytic detects potentially suspicious modifications to
@@ -17,7 +17,7 @@ description: The following analytic detects potentially suspicious modifications
1717
data_source:
1818
- Sysmon EventID 13
1919
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
20-
as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_key_name="*\\Control\\Lsa"
20+
as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Control\\Lsa*"
2121
Registry.registry_value_name IN ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects",
2222
"AuditBaseDirectories") by Registry.action Registry.dest Registry.process_guid Registry.process_id
2323
Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data

‎detections/endpoint/windows_impair_defense_overide_win_defender_phishing_filter.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
name: Windows Impair Defense Overide Win Defender Phishing Filter
22
id: 10ca081c-57b1-4a78-ba56-14a40a7e116a
3-
version: 7
4-
date: '2025-05-02'
5-
author: Teoderick Contreras, Splunk
3+
version: 8
4+
date: '2025-07-30'
5+
author: Teoderick Contreras, Bhavin Patel, Splunk
66
status: production
77
type: TTP
88
data_source:
@@ -16,8 +16,8 @@ description: The following analytic detects modifications to the Windows registr
1616
lead to users unknowingly accessing harmful sites, resulting in potential security
1717
incidents or data compromises.
1818
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
19-
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name =
20-
"*\\MicrosoftEdge\\PhishingFilter" Registry.registry_value_name IN ("EnabledV9",
19+
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path =
20+
"*\\MicrosoftEdge\\PhishingFilter*" Registry.registry_value_name IN ("EnabledV9",
2121
"PreventOverride") Registry.registry_value_data="0x00000000" by Registry.action
2222
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
2323
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name

‎detections/endpoint/windows_phishing_recent_iso_exec_registry.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
name: Windows Phishing Recent ISO Exec Registry
22
id: cb38ee66-8ae5-47de-bd66-231c7bbc0b2c
3-
version: 8
4-
date: '2025-05-02'
5-
author: Teoderick Contreras, Splunk
3+
version: 9
4+
date: '2025-07-30'
5+
author: Teoderick Contreras, Bhavin Patel, Splunk
66
status: production
77
type: Hunting
88
description: The following analytic detects the creation of registry artifacts when
@@ -16,8 +16,8 @@ description: The following analytic detects the creation of registry artifacts w
1616
data_source:
1717
- Sysmon EventID 13
1818
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
19-
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso"
20-
OR Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img"
19+
as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso*"
20+
OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.img*"
2121
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
2222
Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
2323
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product

0 commit comments

Comments
 (0)