From d3ebb7f80c66717e77f84c8f3b2d6e65549f9a11 Mon Sep 17 00:00:00 2001 From: rad9800 <105589633+rad9800@users.noreply.github.com> Date: Wed, 25 Dec 2024 22:06:58 +0000 Subject: [PATCH] [Tuning] Uncommon Registry Persistence Change (#4286) * Update persistence_registry_uncommon.toml Add registry rules for additional SMSS persistence vectors * Update persistence_registry_uncommon.toml * Update persistence_registry_uncommon.toml --------- Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> (cherry picked from commit c99cf9279d417416c06007061db1327183f7fd19) --- rules/windows/persistence_registry_uncommon.toml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/rules/windows/persistence_registry_uncommon.toml b/rules/windows/persistence_registry_uncommon.toml index e6abedebc9e..dba7ca9b4e9 100644 --- a/rules/windows/persistence_registry_uncommon.toml +++ b/rules/windows/persistence_registry_uncommon.toml @@ -2,7 +2,7 @@ creation_date = "2020/11/18" integration = ["endpoint", "windows"] maturity = "production" -updated_date = "2024/10/17" +updated_date = "2024/12/10" min_stack_version = "8.14.0" min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration." @@ -17,7 +17,10 @@ index = ["logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", language = "eql" license = "Elastic License v2" name = "Uncommon Registry Persistence Change" -references = ["https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2"] +references = [ +"https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2", +"https://github.com/rad9800/BootExecuteEDR" +] risk_score = 47 rule_id = "54902e45-3467-49a4-8abc-529f2c8cfb80" severity = "medium" @@ -79,7 +82,10 @@ registry where host.os.type == "windows" and event.type == "change" and "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\Wds\\rdpwd\\StartupPrograms", "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram", "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute", + "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecuteNoPnpSync", "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute", + "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecuteNoPnpSync", + "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\PlatformExecute", "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute", "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\S0InitialCommand", "HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension",