Name:Windows New InProcServer32 Added id:0fa86e31-0f73-4ec7-9ca3-dc88e117f1db version:4 date:2024-10-17 author:Michael Haag, Splunk status:production type:Hunting Description:The following analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. It leverages data from the Endpoint.Registry datamodel to identify changes in registry paths associated with InProcServer32. This activity is significant because malware often uses this mechanism to achieve persistence or execute malicious code by registering a new InProcServer32 key pointing to a harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security. Data_source:
-Sysmon EventID 13
search:| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\InProcServer32\\*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.dest Registry.process_guid Registry.user | `drop_dm_object_name(Registry)` |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_inprocserver32_added_filter`
how_to_implement:To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. known_false_positives:False positives are expected. Filtering will be needed to properly reduce legitimate applications from the results. References: -https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/ drilldown_searches:
: tags: analytic_story: - 'Outlook RCE CVE-2024-21378' asset_type:Endpoint confidence:20 impact:10 message:A new InProcServer32 registry key was added to a Windows endpoint. This could indicate suspicious or malicious activity on the $dest$ . mitre_attack_id: - 'T1112' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - 'Registry.registry_path' - 'Registry.registry_key_name' - 'Registry.registry_value_name' - 'Registry.registry_value_data' - 'Registry.dest' - 'Registry.process_guid' - 'Registry.user' risk_score:2 security_domain:endpoint cve: - 'CVE-2024-21378'
