NullSessionPipe Registry Modification

 1[metadata]
 2creation_date = "2021/03/22"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be
11indicative of adversary lateral movement preparation by making the added pipe available to everyone.
12"""
13from = "now-9m"
14index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
15language = "eql"
16license = "Elastic License v2"
17name = "NullSessionPipe Registry Modification"
18references = [
19    "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/",
20    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares",
21]
22risk_score = 47
23rule_id = "ddab1f5f-7089-44f5-9fda-de5b11322e77"
24severity = "medium"
25tags = [
26    "Domain: Endpoint",
27    "OS: Windows",
28    "Use Case: Threat Detection",
29    "Tactic: Lateral Movement",
30    "Tactic: Defense Evasion",
31    "Data Source: Elastic Endgame",
32    "Data Source: Elastic Defend",
33    "Data Source: Sysmon",
34]
35timestamp_override = "event.ingested"
36type = "eql"
37
38query = '''
39registry where host.os.type == "windows" and event.type in ("creation", "change") and
40registry.path : (
41    "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes",
42    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes"
43) and length(registry.data.strings) > 0
44'''
45
46
47[[rule.threat]]
48framework = "MITRE ATT&CK"
49[[rule.threat.technique]]
50id = "T1021"
51name = "Remote Services"
52reference = "https://attack.mitre.org/techniques/T1021/"
53[[rule.threat.technique.subtechnique]]
54id = "T1021.002"
55name = "SMB/Windows Admin Shares"
56reference = "https://attack.mitre.org/techniques/T1021/002/"
57
58
59
60[rule.threat.tactic]
61id = "TA0008"
62name = "Lateral Movement"
63reference = "https://attack.mitre.org/tactics/TA0008/"
64[[rule.threat]]
65framework = "MITRE ATT&CK"
66[[rule.threat.technique]]
67id = "T1112"
68name = "Modify Registry"
69reference = "https://attack.mitre.org/techniques/T1112/"
70
71
72[rule.threat.tactic]
73id = "TA0005"
74name = "Defense Evasion"
75reference = "https://attack.mitre.org/tactics/TA0005/"