Skip to content

[Rule Tuning] Sysmon Registry-based Rules Review & Fixes#1775

Merged
w0rk3r merged 2 commits intomainfrom
sysmon_registry
Feb 15, 2022
Merged

[Rule Tuning] Sysmon Registry-based Rules Review & Fixes#1775
w0rk3r merged 2 commits intomainfrom
sysmon_registry

Conversation

@w0rk3r
Copy link
Copy Markdown
Contributor

@w0rk3r w0rk3r commented Feb 15, 2022

Summary

Resolves #1766
Resolves #1761

Changes:

  • Drops support for sysmon in registry-based rules that look for values other than QWORD & DWORD (Integration Issue, will update once the issue is open)
  • Add HKU version of HKEY_USER keys in supported rules
  • Fix minor syntax errors and lack of wildcards to be compatible with both sysmon and endpoint

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint labels Feb 15, 2022
@w0rk3r w0rk3r self-assigned this Feb 15, 2022
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

registry where event.type in ("creation", "change") and
registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*",
"HLLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*") and
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*") and
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo

"""
from = "now-9m"
index = ["logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
index = ["logs-endpoint.events.*"]
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support

@w0rk3r w0rk3r changed the title [Rule Tuning] Sysmon Rules Review & Fixes [Rule Tuning] Sysmon Registry-based Rules Review & Fixes Feb 15, 2022
Copy link
Copy Markdown
Contributor

@brokensound77 brokensound77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 LGTM

Copy link
Copy Markdown
Contributor

@Samirbous Samirbous left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! 💯

@w0rk3r w0rk3r merged commit 9bbe26f into main Feb 15, 2022
@w0rk3r w0rk3r deleted the sysmon_registry branch February 15, 2022 12:56
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
protectionsmachine pushed a commit that referenced this pull request Feb 15, 2022
* Initial Review of Sysmon Registry Rules

* Update defense_evasion_sip_provider_mod.toml

(cherry picked from commit 9bbe26f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

3 participants