windows_deleted_registry_by_a_non_critical_process_file_path.yml

name: Windows Deleted Registry By A Non Critical Process File Path
id: 15e70689-f55b-489e-8a80-6d0cd6d8aad2
version: 2
date: '2023-04-14'
author: Steven Dick, Teoderick Contreras, Splunk
status: production
type: Anomaly
description: This analytic is to detect deletion of registry with suspicious process
  file path. This technique was seen in Double Zero wiper malware where it will delete
  all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload
  to the targeted hosts. This anomaly detections can catch possible malware or advesaries
  deleting registry as part of defense evasion or even payload impact but can also
  catch for third party application updates or installation. In this scenario false
  positive filter is needed.
data_source:
- Sysmon EventID 12
- Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
  WHERE Registry.action=deleted BY _time span=1h Registry.dest Registry.registry_path
  Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data
  Registry.action | `drop_dm_object_name(Registry)` | join process_guid [| tstats
  `security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT
  (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h
  Processes.process_id Processes.process_name Processes.process Processes.user Processes.parent_process_name
  Processes.parent_process Processes.process_path Processes.process_guid | `drop_dm_object_name(Processes)`]
  | fields _time parent_process_name parent_process process_name process_path process
  process_guid registry_path registry_value_name registry_value_data registry_key_name
  action dest user | `windows_deleted_registry_by_a_non_critical_process_file_path_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
  telemetry from the endpoints where the agent is installed. To implement this search,
  you must ingest logs that contain the process GUID, process name, and parent process.
  Additionally, you must ingest complete command-line executions. These logs must
  be processed using the appropriate Splunk Technology Add-ons that are specific to
  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
  data model. Use the Splunk Common Information Model (CIM) to normalize the field
  names and speed up the data modeling process.
known_false_positives: This detection can catch for third party application updates
  or installation. In this scenario false positive filter is needed.
references:
- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
tags:
  analytic_story:
  - Data Destruction
  - Double Zero Destructor
  asset_type: Endpoint
  confidence: 60
  impact: 60
  message: The registry was deleted by a suspicious process named $process_name$ with the process path $process_path$ on dest $dest$.
  mitre_attack_id:
  - T1112
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - Processes.user
  - Processes.dest
  - Processes.process_id
  - Processes.process_name
  - Processes.process
  - Processes.process_path
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.process_guid
  - Registry.dest
  - Registry.registry_value_name
  - Registry.registry_key_name
  - Registry.registry_path
  - Registry.registry_value_data
  - Registry.process_guid
  risk_score: 36
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog