Detection rules › Splunk
Registry Entry Created - PowerShell (PowerShell)
Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. This use case detects PowerShell scripts or commands creating new registry entries.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Defense Impairment |
References
Telemetry coverage
Rule body
id: '20185.35853'
title: Registry Entry Created - PowerShell
description: 'Adversaries may interact with the Windows Registry to hide configuration
information within Registry keys, remove information as part of cleaning up, or
as part of other techniques to aid in persistence and execution. This use case detects
PowerShell scripts or commands creating new registry entries. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` ((EventCode=4104) OR "<EventID>4104<"
OR (EventCode=4103) OR "<EventID>4103<") (TERM(New-Item) OR TERM(New-ItemProperty)
OR TERM(Set-ItemProperty) OR TERM(sp) OR TERM(Set-Item) OR TERM(sip)) ("HKCU" OR
"HKLM" OR "HKU" OR "HKEY_") | regex process="(?i)((New|Set)-Item(Property?)|sp|sip)\s+(-Path\s+?)(\"(HKCU|HKLM|HKU|HKEY_))"|
table _time, host, user user, process, process_name | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:modify registry
technique_id:
- T1112
data_category:
- PowerShell logs
references:
- https://blog.sygnia.co/breaking-down-casbaneiro-infection-chain-part2?_ga=2.66949422.1638613298.1690290265-1923873697.1682517767
- https://gist.github.com/netbiosX/a114f8822eb20b115e33db55deee6692
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` ((EventCode=4104) OR "<EventID>4104<" OR (EventCode=4103) OR "<EventID>4103<") (TERM(New-Item) OR TERM(New-ItemProperty) OR TERM(Set-ItemProperty) OR TERM(sp) OR TERM(Set-Item) OR TERM(sip)) ("HKCU" OR "HKLM" OR "HKU" OR "HKEY_")
Stage 2: regex
| regex process="(?i)((New|Set)-Item(Property?)|sp|sip)\s+(-Path\s+?)(\"(HKCU|HKLM|HKU|HKEY_))"
Stage 3: table
| table _time, host, user user, process, process_name
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4104<" |
| 1 | "<EventID>4103<" |
| 1 | "New-Item" |
| 1 | "New-ItemProperty" |
| 1 | "Set-ItemProperty" |
| 1 | sp |
| 1 | "Set-Item" |
| 1 | sip |
| 1 | "HKCU" |
| 1 | "HKLM" |
| 1 | "HKU" |
| 1 | "HKEY_" |