Dev-0270 Registry IOC - September 2022

Status: available
Severity: high
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

The query below identifies modification of registry by Dev-0270 actor to disable security feature as well as to add ransom notes

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 2566e99f-ad0f-472a-b9ac-d3899c9283e6
name: Dev-0270 Registry IOC - September 2022
description: | 
  'The query below identifies modification of registry by Dev-0270 actor to disable security feature as well as to add ransom notes'
severity: High 
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 6h 
queryPeriod: 6h 
triggerOperator: gt 
triggerThreshold: 0 
status: Available
tactics: 
  - Impact
relevantTechniques:
  - T1486
tags:
  - Dev-0270
query: |
  (union isfuzzy=true
  (SecurityEvent
  | where EventID == 4688
  | where (CommandLine has_all  ('reg', 'add', 'HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f') and CommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', 'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource'))
    or CommandLine has_all ('reg', 'add', 'HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')
  | project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
  ),
  (DeviceProcessEvents 
  | where (InitiatingProcessCommandLine has_all(@'"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f') 
     and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', 'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource') ) 
     or InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')
  | extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName
   )
   )
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.3
kind: Scheduled

Stages and Predicates

union `isfuzzy=true` (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: SecurityEvent, DeviceProcessEvents

Leg 1: `SecurityEvent`

SecurityEvent
| where EventID == 4688
| where (CommandLine has_all  ('reg', 'add', 'HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f') and CommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', 'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource'))
  or CommandLine has_all ('reg', 'add', 'HKLM\\SOFTWARE\\Policies\\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')
| project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type

Leg 2: `DeviceProcessEvents`

DeviceProcessEvents 
| where (InitiatingProcessCommandLine has_all(@'"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f') 
   and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup', 'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource') ) 
   or InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')
| extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName

Applied to the combined result

| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/d` transforms: `term` corpus 4 (sigma 3, kusto 1) `/f` transforms: `term` corpus 7 (sigma 5, splunk 1, kusto 1) `/t` transforms: `term` corpus 2 (splunk 1, kusto 1) `/v` transforms: `term` corpus 5 (sigma 4, kusto 1) `@` transforms: `term` corpus 3 (elastic 1, splunk 1, kusto 1) `DisableRealtimeMonitoring` transforms: `term` corpus 3 (sigma 2, kusto 1) `EnableBDEWithNoTPM` transforms: `term` corpus 3 (sigma 2, kusto 1) `HKLM\SOFTWARE\Policies\` transforms: `term` `REG_DWORD` transforms: `term` corpus 2 (sigma 1, kusto 1) `RecoveryKeyMessage` transforms: `term` corpus 3 (sigma 2, kusto 1) `RecoveryKeyMessageSource` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseAdvancedStartup` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseTPMKey` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseTPMKeyPIN` transforms: `term` corpus 3 (sigma 2, kusto 1) `Your drives are Encrypted!` transforms: `term` `add` transforms: `term` corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2) `reg` transforms: `term` corpus 7 (sigma 5, splunk 1, kusto 1)	`field:"CommandLine" kind:match`
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`InitiatingProcessCommandLine`	match	`"HKLM\SOFTWARE\Policies\` transforms: `term` `"reg"` transforms: `term` `/d` transforms: `term` corpus 4 (sigma 3, kusto 1) `/f` transforms: `term` corpus 7 (sigma 5, splunk 1, kusto 1) `/t` transforms: `term` corpus 2 (splunk 1, kusto 1) `/v` transforms: `term` corpus 5 (sigma 4, kusto 1) `@` transforms: `term` corpus 3 (elastic 1, splunk 1, kusto 1) `DisableRealtimeMonitoring` transforms: `term` corpus 3 (sigma 2, kusto 1) `EnableBDEWithNoTPM` transforms: `term` corpus 3 (sigma 2, kusto 1) `REG_DWORD` transforms: `term` corpus 2 (sigma 1, kusto 1) `RecoveryKeyMessage` transforms: `term` corpus 3 (sigma 2, kusto 1) `RecoveryKeyMessageSource` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseAdvancedStartup` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseTPMKey` transforms: `term` corpus 3 (sigma 2, kusto 1) `UseTPMKeyPIN` transforms: `term` corpus 3 (sigma 2, kusto 1) `Your drives are Encrypted!` transforms: `term` `add` transforms: `term` corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)	`field:"CommandLine" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Account`	`extend`
`AccountDomain`	`project`
`Activity`	`project`
`CommandLine`	`project`
`Computer`	`extend`
`EventID`	`project`
`EventSourceName`	`project`
`ProcessName`	`project`
`ProcessNameFullPath`	`project`
`TimeGenerated`	`project`
`Type`	`project`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountNTDomain`	`extend`
`AccountName`	`extend`