Try in Splunk Security Cloud

Description

The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier (CLSID) within the registry (usually under HKLM\Software\Classes\CLSID or HKCU\Software\Classes\CLSID). Behind the implementation of a COM class is the server (some binary) that is referenced within registry keys under the CLSID. The LocalServer32 key represents a path to an executable (exe) implementation, and the InprocServer32 key represents a path to a dynamic link library (DLL) implementation (Bohops). During triage, review parallel processes for suspicious activity. Pivot on the process GUID to see the full timeline of events. Analyze the value and look for file modifications. Being this is looking for inprocserver32, a DLL found in the value will most likely be loaded by a parallel process.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint
  • Last Updated: 2021-10-05
  • Author: Michael Haag, Splunk
  • ID: 127c8d08-25ff-11ec-9223-acde48001122

ATT&CK

ID Technique Tactic
T1218.010 Regsvr32 Defense Evasion
T1112 Modify Registry Defense Evasion

| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user 
| `drop_dm_object_name(Processes)` 
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProcServer32\\(Default)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest Registry.process_guid Registry.user 
| `drop_dm_object_name(Registry)` 
| fields _time dest registry_path registry_key_name registry_value_name process_name process_path process process_guid user] 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, process_name registry_path registry_key_name registry_value_name user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `malicious_inprocserver32_modification_filter`

Associated Analytic Story

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Registry node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.

Required field

  • _time
  • dest
  • process_name
  • registry_path
  • registry_key_name
  • registry_value_name
  • user

Kill Chain Phase

  • Exploitation

Known False Positives

False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.

RBA

Risk Score Impact Confidence Message
80.0 80 100 The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1