security-content/detections/disable_remote_uac.yml at develop · jwindley-splunk/security-content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
asset_type: Endpoint
confidence: medium
creation_date: '2017-10-12'
data_metadata:
  data_models:
    - Endpoint
  data_source:
    - Endpoint Intel
  providing_technologies:
    - Carbon Black Response
    - CrowdStrike Falcon
    - Sysmon
    - Tanium
    - Ziften
description: The search looks for modifications to registry keys that control the
  enforcement of Windows User Account Control (UAC).
detect:
  splunk:
    correlation_rule:
      notable:
        nes_fields: dest, user, registry_path
        rule_description: The registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
          was modified.  This registry key is associated with disabling remote UAC
          on Windows.
        rule_title: Registry Key Associated With Disabling Remote UAC Modified on
          $dest$
      risk:
        risk_object: dest
        risk_object_type:
          - system
        risk_score: 30
      schedule:
        cron_schedule: 0 * * * *
        earliest_time: -70m@m
        latest_time: -10m@m
      search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
        lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy"
        by Registry.dest, Registry.registry_key_name Registry.status Registry.user
        Registry.registry_path Registry.action | `drop_dm_object_name(Registry)`'
      suppress:
        suppress_fields: dest, user, registry_path
        suppress_period: 14400s
eli5: This search checks to see if the registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  was modified.  This registry key can be used to disable remote User Account Control.  The
  search returns the count, the first time activity was seen, last time activity was
  seen, the registry path that was modified, the host where the modification took
  place and the user that performed the modification.
entities:
  - dest
how_to_implement: To successfully implement this search, you must be ingesting data
  that records registry activity from your hosts to populate the endpoint data model
  in the registry node. This is typically populated via endpoint detection-and-response
  products, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
  The data used for this search is typically generated via logs that report registry
  modifications.
id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
investigations:
  - id: fecf2918-670d-4f1c-872b-3d7317a41xf9
    name: Get Registry Activities
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
    name: Get Authentication Logs For Endpoint
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d55
    name: Get Risk Modifiers For User
    type: splunk
  - id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
    name: Get Notable History
    type: splunk
  - id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
    name: Get Notable Info
    type: splunk
  - id: fdcfb369-1725-4c24-824a-22972d7f0d65
    name: Get Risk Modifiers For Endpoint
    type: splunk
  - id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
    name: Get User Information from Identity Table
    type: splunk
known_false_positives: This registry key may be modified via administrators to implement
  a change in system policy. This type of change should be a very rare occurrence.
maintainers:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
mappings:
  cis20:
    - CIS 8
  kill_chain_phases:
    - Actions on Objectives
  mitre_attack:
    - Defense Evasion
    - Modify Registry
  nist:
    - PR.PT
    - DE.CM
modification_date: '2018-12-03'
name: Disabling Remote User Account Control
original_authors:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '2.0'