Detection rules › Splunk

Auto Admin Logon Registry Entry

Author
Teoderick Contreras, Splunk, Steven Dick
Source
upstream

The following analytic detects a suspicious registry modification that enables auto admin logon on a host. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "AutoAdminLogon" value within the "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" registry path. This activity is significant because it was observed in BlackMatter ransomware attacks to maintain access after a safe mode reboot, facilitating further encryption. If confirmed malicious, this could allow attackers to automatically log in and continue their operations, potentially leading to widespread network encryption and data loss.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552.002 Unsecured Credentials: Credentials in Registry

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE Registry.registry_path="*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" Registry.registry_value_data=1 Registry.registry_value_name="AutoAdminLogon" BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: where

where isnotnull(registry_value_data)

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" corpus 2 (splunk 2)
Registry.registry_value_dataeq
  • 1 corpus 2 (splunk 2)
Registry.registry_value_nameeq
  • AutoAdminLogon