NullSessionPipe Registry Modification

 1[metadata]
 2creation_date = "2021/03/22"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be
13indicative of adversary lateral movement preparation by making the added pipe available to everyone.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.*", "endgame-*"]
17language = "eql"
18license = "Elastic License v2"
19name = "NullSessionPipe Registry Modification"
20references = [
21    "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/",
22    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares",
23]
24risk_score = 47
25rule_id = "ddab1f5f-7089-44f5-9fda-de5b11322e77"
26severity = "medium"
27tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
28timestamp_override = "event.ingested"
29type = "eql"
30
31query = '''
32registry where host.os.type == "windows" and event.type in ("creation", "change") and
33registry.path : (
34    "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes",
35    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes"
36) and length(registry.data.strings) > 0
37'''
38
39
40[[rule.threat]]
41framework = "MITRE ATT&CK"
42[[rule.threat.technique]]
43id = "T1021"
44name = "Remote Services"
45reference = "https://attack.mitre.org/techniques/T1021/"
46[[rule.threat.technique.subtechnique]]
47id = "T1021.002"
48name = "SMB/Windows Admin Shares"
49reference = "https://attack.mitre.org/techniques/T1021/002/"
50
51
52
53[rule.threat.tactic]
54id = "TA0008"
55name = "Lateral Movement"
56reference = "https://attack.mitre.org/tactics/TA0008/"