Detection rules › Splunk
Suspicious Registry Key Created (PowerShell)
Adversaries may achieve persistence by adding a program or referencing it with a Registry run key or by utilizing content triggered by Image File Execution Options (IFEO) debugger keys. Run keys may exist under multiple hives and IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits. Multiple APTs leverage these Hives in order to establish persistence or execute additional payloads that appear to blend in with normal traffic. -- Threat Group Association: APT29/Nobelium/Cozy Bear, APT31, Kimsuky, TA505, Wizard Spider
MITRE ATT&CK coverage
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '5857.6625'
title: Suspicious Registry Key Created
description: 'Adversaries may achieve persistence by adding a program or referencing
it with a Registry run key or by utilizing content triggered by Image File Execution
Options (IFEO) debugger keys. Run keys may exist under multiple hives and IFEOs
can also enable an arbitrary monitor program to be launched when a specified program
silently exits. Multiple APTs leverage these Hives in order to establish persistence
or execute additional payloads that appear to blend in with normal traffic. -- Threat
Group Association: APT29/Nobelium/Cozy Bear, APT31, Kimsuky, TA505, Wizard Spider
-- Software Association: BABYSHARK, Bazar, DirtyMoe, GhostShell, TrickBot -- Atomics
T1003 Test #2 Atomic T1574.012 Test#1 Atomic T1574.012 Test#2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(new-itemproperty)
("HKLM" OR "HKCU") ("dll" OR "vbs") | table _time, host, user process, process_*,
signature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
- persistence:event triggered execution:image file execution options injection
- privilege-escalation:boot or logon autostart execution:registry run keys / startup
folder
- privilege-escalation:event triggered execution:image file execution options injection
technique_id:
- T1547.001
- T1546.012
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2021/09/tinyturla.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(new-itemproperty) ("HKLM" OR "HKCU") ("dll" OR "vbs")
Stage 2: table
| table _time, host, user process, process_*, signature_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "new-itemproperty" |
| 1 | "HKLM" |
| 1 | "HKCU" |
| 1 | "dll" |
| 1 | "vbs" |