[BUG] Windows New EventLog ChannelAccess Registry Value Set: second path has single backslashes

Open Beginner friendly
  • Is something wrong?
#4,417 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Domain
security

Research direction

The bad pattern is in the search field of detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml, in the Registry.registry_path IN (...) clause. Compare the second path's backslashes with the first, which is written correctly. To check the fix, rerun the tstats query described in the issue against the sysmon log at datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log. Done when the Policies\Microsoft\Windows\EventLog\Setup\ChannelAccess row is matched.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml (id 16eb11bc-ef42-42e8-9d0c-d21e0fa15725, version 8) has this path list in its search:

Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*")

The first pattern has doubled backslashes. The second has single backslashes. In a tstats WHERE value, the second pattern matches nothing.

I loaded the test recording of the rule, datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon.log in attack_data (9 Sysmon events, 3 of them ChannelAccess), into Splunk Enterprise 9.3.14 and ran tstats on the Endpoint.Registry data model with Registry.registry_value_name=ChannelAccess:

Pattern Distinct registry paths matched
*\\Microsoft\\Windows\\CurrentVersion\\* 2
*\Microsoft\Windows\CurrentVersion\* 0
*MicrosoftWindowsCurrentVersion* (the same text without the backslashes) 0
*\\Microsoft\\Windows\\EventLog\\* 1
*\Microsoft\Windows\EventLog\* 0

The three ChannelAccess events (Sysmon event 13) are:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-TaskScheduler/Operational\ChannelAccess   (regedit.exe)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\AMSI/Debug\ChannelAccess                                   (regedit.exe)
HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup\ChannelAccess                                                      (svchost.exe, Details O:SYG:SYD:(D;;0x1;;;WD))

The search of the rule, as it is in release v6.10.0 and unchanged, returns the two WINEVT\Channels rows and not the Policies\Microsoft\Windows\EventLog\Setup\ChannelAccess row. With the backslashes of the second pattern doubled, "*\\Microsoft\\Windows\\EventLog\\*", the same search returns all three. The search returns rows in both cases, so a test that needs at least one result does not show the gap.

Expected behavior

The second pattern matches the Group Policy location of the same value (...\Policies\Microsoft\Windows\EventLog\<channel>\ChannelAccess), as the third event above shows. It should be written like the first pattern.

Suggested change: "*\\Microsoft\\Windows\\EventLog\\*".

Screenshots

None.

App Version:
  • ESCU: 6.10.0 (the search text is the same in release v6.10.0 and on develop)
  • Splunk Security Essentials: Not applicable
Additional context

None.

Dominant language
Python
Stars
1.7k
Forks
507
Avg merge
2d 17h
Merged PRs (30d)
35

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/security_content

All issues in splunk/security_content

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.