update reg analytics

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -1,11 +1,12 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: '11'
-date: '2024-11-28'
+version: 12
+date: '2025-01-15'
 author: Patrick Bareiss, Splunk
-status: production
+status: deprecated
 type: TTP
-description: The following analytic detects the execution of reg.exe with parameters
+description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122".
+  The following analytic detects the execution of reg.exe with parameters
   that export registry keys containing hashed credentials. It leverages data from
   Endpoint Detection and Response (EDR) agents, focusing on command-line executions
   involving reg.exe or cmd.exe with specific registry paths. This activity is significant

detections/endpoint/windows_query_registry_reg_save.yml → detections/endpoint/windows_registry_entries_exported_via_reg.yml

@@ -1,16 +1,16 @@
-name: Windows Query Registry Reg Save
+name: Windows Registry Entries Exported Via Reg
 id: cbee60c1-b776-456f-83c2-faa56bdbe6c6
 version: 3
 date: '2024-10-17'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
-description: The following analytic detects the execution of the reg.exe process with the "save" parameter. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry.
+description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry.
 data_source:
 - Sysmon EventID 1
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  `process_reg` AND Processes.process = "* save *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_reg_save_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  `process_reg` AND Processes.process IN ("* save *", "* export *") by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
 references:

detections/endpoint/windows_modify_registry_reg_restore.yml → detections/endpoint/windows_registry_entries_restored_via_reg.yml

@@ -1,7 +1,7 @@
-name: Windows Modify Registry Reg Restore
+name: Windows Registry Entries Restored Via Reg
 id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e
-version: 3
-date: '2024-10-17'
+version: 4
+date: '2025-01-14'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -10,7 +10,7 @@ data_source:
 - Sysmon EventID 1
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where  `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_reg_restore_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries.
 references:

detections/endpoint/extraction_of_registry_hives.yml → detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml

@@ -1,16 +1,16 @@
-name: Extraction of Registry Hives
+name: Windows Sensitive Registry Hive Dump Via CommandLine
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
-version: 4
-date: '2024-09-30'
-author: Michael Haag, Splunk
+version: 5
+date: '2025-01-15'
+author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk
 status: production
 type: TTP
 description: The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.
 data_source:
 - Sysmon EventID 1
 - Windows Event Log Security 4688
 - CrowdStrike ProcessRollup2
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` AND (Processes.process=*save* OR Processes.process=*export*)) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND (Processes.process="*HKEY_LOCAL_MACHINE*" OR Processes.process="*HKLM*") AND (Processes.process="*\sam*" OR Processes.process="*\system*" OR Processes.process="*\security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`'
 how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
 known_false_positives: It is possible some agent based products will generate false positives. Filter as needed.
 references:
@@ -28,15 +28,19 @@ drilldown_searches:
   latest_offset: $info_max_time$
 tags:
   analytic_story:
-  - Volt Typhoon
-  - Credential Dumping
+  - CISA AA22-257A
   - CISA AA23-347A
+  - Compromised Windows Host
+  - Credential Dumping
   - DarkSide Ransomware
-  - CISA AA22-257A
+  - Data Destruction
+  - Industroyer2
+  - Volt Typhoon
+  - Windows Registry Abuse
   asset_type: Endpoint
   confidence: 70
   impact: 80
-  message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
+  message: Suspicious use of `reg.exe` or `regedit.exe` to export sensitive registry hives that could potentially contain credentials, executed on $dest$ by user $user$, with a parent process of $parent_process_name$
   mitre_attack_id:
   - T1003.002
   - T1003
@@ -78,3 +82,8 @@ tests:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

macros/process_regedit.yml

@@ -0,0 +1,3 @@
+definition: (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe)
+description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+name: process_regedit