Suspicious NullSessionPipe Registry Modification

[rule]
description = """
Identifies NullSessionPipe registry modifications that specify pipe names that can be accessed anonymously. This could
be indicative of adversary lateral movement preparation by making the added pipe accessible to remote systems.
"""
id = "11d374d8-2dad-4d9b-83a2-ee908eac8269"
license = "Elastic License v2"
name = "Suspicious NullSessionPipe Registry Modification"
os_list = ["windows"]
reference = [
    "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/",
    "https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/",
    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares",
]
version = "1.0.28"

query = '''
registry where
 event.action == "modification" and 
 registry.path : "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes" and 
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
 registry.data.strings : "*?*" and process.executable : "?:\\*" and
 not process.executable : ("?:\\Program Files\\*.exe",
                           "?:\\Program Files (x86)\\*.exe",
                           "?:\\Windows\\regedit.exe",
                           "?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\*.exe",
                           "?:\\Windows\\System32\\svchost.exe",
                           "?:\\Windows\\System32\\lsass.exe",
                           "?:\\Windows\\System32\\msiexec.exe",
                           "?:\\Windows\\System32\\services.exe",
                           "?:\\Windows\\System32\\PDR23PM_SV64.EXE", 
                           "?:\\Windows\\System32\\PLPOUSVR.exe")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.15.0"