Splunk unknown stable spl

Windows SnappyBee Create Test Registry

The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior.

View Source

Detection Logic

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
FROM datamodel=Endpoint.Registry 
WHERE Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Test\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
| `drop_dm_object_name(Registry)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_snappybee_create_test_registry_filter`

False Positives

  • ⚠ Administrators and third party software may create this registry entry.

Field Validations

Loading…

Comments (0)

Loading comments...