security_content/dev/endpoint/disabling_systemrestore_in_registry.yml at develop · codingWithJimmy/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Disabling SystemRestore In Registry
id: f4f837e2-91fb-11eb-8bf6-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following search identifies the modification of registry related
  in disabling the system restore of a machine. This event or behavior are seen in
  some RAT malware to make the restore of the infected machine  difficult and keep
  their infection on the box.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Details: '0x00000001'
    TargetObject:
    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig'
    - '*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR'
    - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig'
    - '*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR'
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
known_false_positives: in some cases admin can disable systemrestore on a machine.
references:
- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
tags:
  analytic_story:
  - Windows Defense Evasion Tactics
  - Windows Registry Abuse
  asset_type: Endpoint
  confidence: 70
  impact: 70
  message: The Windows registry was modified to disable system restore on $dest$ by
    $user$.
  mitre_attack_id:
  - T1490
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 49
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
    source: WinEventLog:Security
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
    source: WinEventLog:System
    sourcetype: WinEventLog
    update_timestamp: true
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog