Detection rules › Splunk

Add DefaultUser And Password In Registry

Author
Teoderick Contreras, Splunk, Steven Dick
Source
upstream

The following analytic detects suspicious registry modifications that implement auto admin logon by adding DefaultUserName and DefaultPassword values. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" registry path. This activity is significant because it is associated with BlackMatter ransomware, which uses this technique to automatically log on to compromised hosts and continue encryption after a safe mode boot. If confirmed malicious, this could allow attackers to maintain persistence and further encrypt the network, leading to significant data loss and operational disruption.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552.002 Unsecured Credentials: Credentials in Registry

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE ((Registry.registry_path="*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" Registry.registry_value_name="DefaultPassword") OR Registry.registry_value_name="DefaultUserName") BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" corpus 2 (splunk 2)
Registry.registry_value_nameeq
  • DefaultPassword
  • DefaultUserName