Registry Edit with Creation of SafeDllSearchMode Key Set to 0

Hypothesis and description

Detection of creation of registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode. The key SafeDllSearchMode, if set to 0, will block the Windows mechanism for the search DLL order and adversaries may execute their own malicious dll.

Platforms: Windows
Domain: Host
Subtypes: Process, Registry
Submitted: 2021-11-24
Contributors: Lucas Heiligenstein

ATT&CK coverage

Technique	Tactics	Coverage
T1574 Hijack Execution FlowT1574.001	Persistence, Privilege Escalation, Stealth (formerly Defense Evasion)	Medium
T1112 Modify Registry	Stealth (formerly Defense Evasion)	Medium

2 techniques, 3 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeCreation of SafeDllSearchModeData model: CAR native

This detects SafeDllSearchMode creation, either via a new process (command line) or direct registry manipulation.

processes = search Process:create
safe_dll_search_processes = filter processes where command_line CONTAINS("*SafeDllSearchMode*") AND ((command_line CONTAINS("*reg*") AND command_line CONTAINS("*add*") AND command_line CONTAINS("*/d*")) OR (command_line CONTAINS("*Set-ItemProperty*") AND command_line CONTAINS(*-value*)) OR ((command_line CONTAINS("*00000000*") AND command_line CONTAINS(*0*)))
reg_keys = search Registry:value_edit
safe_dll_reg_keys = filter reg_keys where value="SafeDllSearchMode" AND value_data="0"
output safe_dll_search_processes, safe_dll_reg_keys

SplunkSplunk Search - Creation of SafeDllSearchModeData model: Win. Eventlog/Sysmon native

This is a Splunk representation of the above pseudocode.

(source="WinEventLog:*" ((((EventCode="4688" OR EventCode="1") ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR (CommandLine="*Set-ItemProperty*" CommandLine="*-value*")) (CommandLine="*00000000*" OR CommandLine="*0*") CommandLine="*SafeDllSearchMode*") OR ((EventCode="4657") ObjectValueName="SafeDllSearchMode" value="0")) OR ((EventCode="13") EventType="SetValue" TargetObject="*SafeDllSearchMode" Details="DWORD (0x00000000)")))

ElasticElastic Search - Creation of SafeDllSearchModeData model: Win. Eventlog/Sysmon native

This is an Elastic representation of the above pseudocode.

(((EventCode:("4688" OR "1") AND ((process.command_line:*reg* AND process.command_line:*add* AND process.command_line:*\/d*) OR (process.command_line:*Set\-ItemProperty* AND process.command_line:*\-value*)) AND process.command_line:(*00000000* OR *0*) AND process.command_line:*SafeDllSearchMode*) OR (EventCode:"4657" AND winlog.event_data.ObjectValueName:"SafeDllSearchMode" AND value:"0")) OR (EventCode:"13" AND winlog.event_data.EventType:"SetValue" AND winlog.event_data.TargetObject:*SafeDllSearchMode AND winlog.event_data.Details:"DWORD\ \(0x00000000\)"))

LogPointLogPoint Search - Creation of SafeDllSearchModeData model: Win. Eventlog/Sysmon native

This is a LogPoint representation of the above pseudocode.

(((EventCode IN ["4688", "1"] ((CommandLine="*reg*" CommandLine="*add*" CommandLine="*/d*") OR (CommandLine="*Set-ItemProperty*" CommandLine="*-value*")) CommandLine IN ["*00000000*", "*0*"] CommandLine="*SafeDllSearchMode*") OR (EventCode IN "4657" ObjectValueName="SafeDllSearchMode" value="0")) OR (EventCode IN "13" EventType="SetValue" TargetObject="*SafeDllSearchMode" Details="DWORD (0x00000000)"))

Across MITRE's defensive frameworks

Linked through the 2 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

15 more in the full list

View CAR-2021-11-001 on car.mitre.org