Anvilogic high experimental spl

Add DLL_EXE Registry Value [splunk-sysmon]

Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. -- Threat Actor Association: CL-STA-0043, FamousSparrow, FIN6, Flax Typhoon, WIRTE -- Software Association: Blackbyte

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_sysmon` ( signature_id=13 
AND (TERM(HKU) 
OR TERM(HKCU) 
OR TERM(HKLM)) 
AND (registry_value_name="*\\Temp\\*.exe" 
OR registry_value_name="*\\Temp\\*.dll" 
OR registry_value_name="*\\Common Files\\*.dll" 
OR registry_value_name="*\\Common Files\\*.exe") )
| table _time, host, user, process process_name, parent_process_name, signature_id, dest_ip, registry_value_name
| bin span=1s
| stats values(*) as * by _time, host
| table _time, host, user, process process_name, parent_process_name, signature_id dest_ip registry_value_name `hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...