Detection rules › Splunk

Windows Modify Registry With MD5 Reg Key Name

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects potentially malicious registry modifications characterized by MD5-like registry key names. It leverages the Endpoint data model to identify registry entries under the SOFTWARE path with 32-character hexadecimal names, a technique often used by NjRAT malware for fileless storage of keylogs and .DLL plugins. This activity is significant as it can indicate the presence of NjRAT or similar malware, which can lead to unauthorized data access and persistent threats within the environment. If confirmed malicious, attackers could maintain persistence and exfiltrate sensitive information.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense EvasionT1112 Modify Registry

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE Registry.registry_path="*\\SOFTWARE\\*" Registry.registry_value_data="Binary Data" BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: eval

eval ... using (registry_path)

Stage 4: eval

eval ... using (dropped_reg_path)

Stage 5: eval

eval ... using (registry_value_name)

Stage 6: where

where dropped_reg_path_split_count<=5 validation_result="md5"

Stage 7: table

table dest, dropped_reg_path_split_count, reg_key_name, registry_key_name, registry_path, registry_value_data, registry_value_name, user, validation_result

Stage 8: search

search

Stage 9: search

search

Stage 10: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.registry_patheq
  • "*\\SOFTWARE\\*"
Registry.registry_value_dataeq
  • "Binary Data" corpus 3 (splunk 3)
dropped_reg_path_split_countle
  • 5
validation_resulteq
  • "md5"