Detection: Detect Remote Access Software Usage Registry

Created: 2024-12-28 Last Updated: 2026-10-19 ID: 33804986-25dd-43cf-bb6b-dc14956c7cbc Author: Steven Dick, Onur Mustafa Erdogan, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5        latest(Registry.process_guid) as process_guid
 6
 7FROM datamodel=Endpoint.Registry WHERE
 8
 9(
10    Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*"
11    OR
12    (
13        Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*"
14        Registry.registry_value_name="ImagePath"
15    )
16)
17(
18    [
19        
20| inputlookup remote_access_software
21        
22| search file_name!=""
23        
24| eval file_name="*".file_name."*"
25        
26| rex mode=sed field=file_name "s/\*\*/\*/g"
27        
28| rename file_name as Registry.registry_value_data
29        
30| table Registry.registry_value_data
31    ]
32    OR
33    [
34        
35| inputlookup remote_access_software
36        
37| search file_path!=""
38        
39| eval file_path="*".file_path."*"
40        
41| rex mode=sed field=file_path "s/\*\*/\*/g"
42        
43| rename file_path as Registry.registry_value_data
44        
45| table Registry.registry_value_data
46    ]
47)
48
49BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
50   Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
51   Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
52
53
54| `drop_dm_object_name(Registry)`
55
56
57| rex field=registry_value_data "(?i)(?:^
58|\x5c)(?<file_name>[^\x5c/\x27\x22]+\.\w{2,5})\b"
59
60| rex field=registry_value_data "(?i)(?<file_path>\w:\x5c(?:[^\x5c/\x27\x22]+\x5c)+[^\x5c/\x27\x22]+\.\w{2,5})\b"
61
62
63| lookup local=t remote_access_software file_name OUTPUT app as name_signature, category as name_category, reference as name_reference, description as name_description
64
65| lookup local=t remote_access_software file_path OUTPUT app as path_signature, category as path_category, reference as path_reference, description as path_description
66
67| eval signature=coalesce(nullif(name_signature, ""), path_signature),
68       category=coalesce(nullif(name_category, ""), path_category),
69       reference=coalesce(nullif(name_reference, ""), path_reference),
70       description=coalesce(nullif(name_description, ""), path_description)
71
72
73| `security_content_ctime(firstTime)`
74
75| `security_content_ctime(lastTime)`
76
77
78| `remote_access_software_usage_exceptions`
79
80
81| `detect_remote_access_software_usage_registry_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 13	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
detect_remote_access_software_usage_registry_filter	`search *`

detect_remote_access_software_usage_registry_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1219	Remote Access Tools	Command and Control

Command and Control

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Registry node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections.

Known False Positives

Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$].	user	user	20
Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$].	dest	system	20

Threat Objects

Field	Type
signature	signature
registry_path	registry_path

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15