Analytics Story: Windows Registry Abuse

Date: 2022-03-17 ID: 78df1df1-25f1-4387-90f9-c4ea31ce6b75 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner.

Why it matters

Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability, most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection.

1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*registry*") All_Risk.annotations.mitre_attack.mitre_technique_id IN ("*T1112*") by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 3 | `windows_modify_registry_risk_behavior_filter`

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Allow Inbound Traffic By Firewall Rule Registry Remote Desktop Protocol TTP
Allow Operation with Consent Admin Abuse Elevation Control Mechanism TTP
Auto Admin Logon Registry Entry Credentials in Registry TTP
Disable AMSI Through Registry Disable or Modify Tools TTP
Disable Defender AntiVirus Registry Disable or Modify Tools TTP
Disable Defender BlockAtFirstSeen Feature Disable or Modify Tools TTP
Disable Defender Enhanced Notification Disable or Modify Tools TTP
Disable Defender MpEngine Registry Disable or Modify Tools TTP
Disable Defender Spynet Reporting Disable or Modify Tools TTP
Disable Defender Submit Samples Consent Feature Disable or Modify Tools TTP
Disable ETW Through Registry Disable or Modify Tools TTP
Disable Registry Tool Modify Registry, Disable or Modify Tools TTP
Disable Security Logs Using MiniNt Registry Modify Registry TTP
Disable Show Hidden Files Modify Registry, Disable or Modify Tools, Hidden Files and Directories Anomaly
Disable UAC Remote Restriction Bypass User Account Control TTP
Disable Windows App Hotkeys Modify Registry, Disable or Modify Tools TTP
Disable Windows Behavior Monitoring Disable or Modify Tools TTP
Disable Windows SmartScreen Protection Disable or Modify Tools TTP
Disabling CMD Application Modify Registry, Disable or Modify Tools TTP
Disabling ControlPanel Modify Registry, Disable or Modify Tools TTP
Disabling Defender Services Disable or Modify Tools TTP
Disabling FolderOptions Windows Feature Disable or Modify Tools TTP
Disabling NoRun Windows App Modify Registry, Disable or Modify Tools TTP
Disabling Remote User Account Control Bypass User Account Control TTP
Disabling SystemRestore In Registry Inhibit System Recovery TTP
Disabling Task Manager Disable or Modify Tools TTP
Disabling Windows Local Security Authority Defences via Registry Modify Authentication Process TTP
Enable RDP In Other Port Number Remote Services TTP
Enable WDigest UseLogonCredential Registry Modify Registry, OS Credential Dumping TTP
ETW Registry Disabled Trusted Developer Utilities Proxy Execution, Indicator Blocking TTP
Eventvwr UAC Bypass Bypass User Account Control TTP
Hide User Account From Sign-In Screen Disable or Modify Tools TTP
Modification Of Wallpaper Defacement TTP
Monitor Registry Keys for Print Monitors Port Monitors TTP
Registry Keys for Creating SHIM Databases Application Shimming TTP
Registry Keys Used For Persistence Registry Run Keys / Startup Folder TTP
Registry Keys Used For Privilege Escalation Image File Execution Options Injection TTP
Remcos client registry install entry Modify Registry TTP
Revil Registry Entry Modify Registry TTP
Screensaver Event Trigger Execution Screensaver TTP
Sdclt UAC Bypass Bypass User Account Control TTP
SilentCleanup UAC Bypass Bypass User Account Control TTP
Time Provider Persistence Registry Time Providers TTP
Windows AD DSRM Account Changes Account Manipulation TTP
Windows Autostart Execution LSASS Driver Registry Modification LSASS Driver TTP
Windows Disable Lock Workstation Feature Through Registry Modify Registry Anomaly
Windows Disable LogOff Button Through Registry Modify Registry Anomaly
Windows Disable Memory Crash Dump Data Destruction TTP
Windows Disable Notification Center Modify Registry Anomaly
Windows Disable Shutdown Button Through Registry Modify Registry Anomaly
Windows Disable Windows Group Policy Features Through Registry Modify Registry Anomaly
Windows DisableAntiSpyware Registry Disable or Modify Tools TTP
Windows Hide Notification Features Through Registry Modify Registry Anomaly
Windows Impair Defense Change Win Defender Health Check Intervals Disable or Modify Tools TTP
Windows Impair Defense Change Win Defender Quick Scan Interval Disable or Modify Tools TTP
Windows Impair Defense Change Win Defender Throttle Rate Disable or Modify Tools TTP
Windows Impair Defense Change Win Defender Tracing Level Disable or Modify Tools TTP
Windows Impair Defense Configure App Install Control Disable or Modify Tools TTP
Windows Impair Defense Define Win Defender Threat Action Disable or Modify Tools TTP
Windows Impair Defense Delete Win Defender Context Menu Disable or Modify Tools Hunting
Windows Impair Defense Delete Win Defender Profile Registry Disable or Modify Tools Anomaly
Windows Impair Defense Disable Controlled Folder Access Disable or Modify Tools TTP
Windows Impair Defense Disable Defender Firewall And Network Disable or Modify Tools TTP
Windows Impair Defense Disable Defender Protocol Recognition Disable or Modify Tools TTP
Windows Impair Defense Disable PUA Protection Disable or Modify Tools TTP
Windows Impair Defense Disable Realtime Signature Delivery Disable or Modify Tools TTP
Windows Impair Defense Disable Web Evaluation Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender App Guard Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Compute File Hashes Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Gen reports Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Network Protection Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Report Infection Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Scan On Update Disable or Modify Tools TTP
Windows Impair Defense Disable Win Defender Signature Retirement Disable or Modify Tools TTP
Windows Impair Defense Overide Win Defender Phishing Filter Disable or Modify Tools TTP
Windows Impair Defense Override SmartScreen Prompt Disable or Modify Tools TTP
Windows Impair Defense Set Win Defender Smart Screen Level To Warn Disable or Modify Tools TTP
Windows Impair Defenses Disable Auto Logger Session Disable or Modify Tools Anomaly
Windows Impair Defenses Disable HVCI Disable or Modify Tools TTP
Windows Impair Defenses Disable Win Defender Auto Logging Disable or Modify Tools Anomaly
Windows Modify Show Compress Color And Info Tip Registry Modify Registry TTP
Windows New Default File Association Value Set Change Default File Association Hunting
Windows Registry Certificate Added Install Root Certificate Anomaly
Windows Registry Delete Task SD Scheduled Task, Impair Defenses Anomaly
Windows Registry Dotnet ETW Disabled Via ENV Variable Indicator Blocking TTP
Windows Registry Modification for Safe Mode Persistence Registry Run Keys / Startup Folder TTP
Windows Sensitive Registry Hive Dump Via CommandLine Security Account Manager TTP
Windows Service Creation Using Registry Entry Services Registry Permissions Weakness Anomaly
WSReset UAC Bypass Bypass User Account Control TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
CrowdStrike ProcessRollup2 N/A crowdstrike:events:sensor crowdstrike
Sysmon EventID 1 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 12 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Windows Event Log Security 4688 Windows icon Windows xmlwineventlog XmlWinEventLog:Security

References

Source: GitHub | Version: 1