Anvilogic high experimental spl

Defender Registry Values Modified [splunk-winevent]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) 
OR "<EventID>4688<" 
OR Type=Process) ("cmd.exe" 
OR "powershell.exe" 
OR "pwsh.exe") "Defender" (("DisableEnhancedNotifications" 
OR "RTP") "1") 
OR (("SubmitSamplesConsent" 
OR "SpynetReporting") "0") 
OR (("Set-ItemProperty" 
OR "sp " 
OR "ADD ") ("SOFTWARE\\Microsoft\\Windows Defender\\Reporting" 
OR "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" 
OR "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection"))) 
OR ((TERM(EventCode=4657) 
OR "<EventID>4657<") ("SOFTWARE\\Microsoft\\Windows Defender\\Reporting" 
OR "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" 
OR "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection"))
| table _time, host, user, process, process_name, registry_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...