---
apiVersion: v1
kind: pack
spec:
  name: windows-registry-monitoring
  queries:
  - description: Technique used by attackers to prevent computer accounts from changing
      their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
    interval: 3600
    name: computer_password_change_disabled_registry
    platform: windows
    query: computer_password_change_disabled_registry
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: error_mode_registry_missing
    platform: windows
    query: error_mode_registry_missing
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: per_user_ts_session_registry_missing
    platform: windows
    query: per_user_ts_session_registry_missing
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: powershell_invocationheader_registry_missing
    platform: windows
    query: powershell_invocationheader_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: bitlocker_encryption_settings_registry_misconfigured
    platform: windows
    query: bitlocker_encryption_settings_registry_misconfigured
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: bitlocker_mbam_registry_misconfigured
    platform: windows
    query: bitlocker_mbam_registry_misconfigured
  - description: Returns the content of this key if it exists, which it shouldn't
      by default
    interval: 3600
    name: dns_plugin_dll_registry_exists
    platform: windows
    query: dns_plugin_dll_registry_exists
  - description: Returns the content of this key if it exists, which it shouldn't
      by default
    interval: 3600
    name: error_display_ui_registry_exists
    platform: windows
    query: error_display_ui_registry_exists
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: log_errors_registry_misconfigured
    platform: windows
    query: log_errors_registry_misconfigured
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: subscription_manager_registry_misconfigured
    platform: windows
    query: subscription_manager_registry_misconfigured
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: subscription_manager_registry_missing
    platform: windows
    query: subscription_manager_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: command_line_auditing_registry_misconfigured
    platform: windows
    query: command_line_auditing_registry_misconfigured
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: crash_dump_registry_missing
    platform: windows
    query: crash_dump_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: error_mode_registry_misconfigured
    platform: windows
    query: error_mode_registry_misconfigured
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: log_errors_registry_missing
    platform: windows
    query: log_errors_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: winrm_settings_registry_misconfigured
    platform: windows
    query: winrm_settings_registry_misconfigured
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: crash_dump_registry_misconfigured
    platform: windows
    query: crash_dump_registry_misconfigured
  - description: Detect a registry based persistence mechanism that allows an attacker
      to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
    interval: 3600
    name: physicalstore_dll_registry_persistence
    platform: windows
    query: physicalstore_dll_registry_persistence
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: powershell_logging_registry_misconfigured
    platform: windows
    query: powershell_logging_registry_misconfigured
  - description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
    interval: 3600
    name: amsi_disabled_registry
    platform: windows
    query: amsi_disabled_registry
  - description: Controls how often to rotate the local computer password (defaults
      to 30 days). A modification of this value may be an indicator of attacker activity.
    interval: 3600
    name: computer_maximum_password_age_changed_registry
    platform: windows
    query: computer_maximum_password_age_changed_registry
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: dr_watson_registry_missing
    platform: windows
    query: dr_watson_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: per_user_ts_session_registry_misconfigured
    platform: windows
    query: per_user_ts_session_registry_misconfigured
  - description: Registry based persistence mechanism to load DLLs at reboot time
      and avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
      Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
      remain.
    interval: 3600
    name: runonceex_persistence_registry
    platform: windows
    query: runonceex_persistence_registry
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: smbv1_registry_missing
    platform: windows
    query: smbv1_registry_missing
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: powershell_transcription_logging_registry_missing
    platform: windows
    query: powershell_transcription_logging_registry_missing
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: powershell_module_logging_registry_missing
    platform: windows
    query: powershell_module_logging_registry_missing
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: powershell_scriptblock_logging_registry_missing
    platform: windows
    query: powershell_scriptblock_logging_registry_missing
  - description: Returns the content of the key if it does not match the expected
      value
    interval: 3600
    name: bitlocker_mbam_endpoint_registry_misconfigured
    platform: windows
    query: bitlocker_mbam_endpoint_registry_misconfigured
  - description: Returns 0 as a result if the registry key does not exist
    interval: 3600
    name: command_line_auditing_registry_missing
    platform: windows
    query: command_line_auditing_registry_missing
  - description: ""
    interval: 3600
    name: smbv1_registry_misconfigured
    platform: windows
    query: smbv1_registry_misconfigured
  - description: Returns the content of this key if it exists, which it shouldn't
      by default
    interval: 3600
    name: send_error_alert_registry_exists
    platform: windows
    query: send_error_alert_registry_exists
  targets:
    labels: 
    - MS Windows
---
apiVersion: v1
kind: query
spec:
  description: Technique used by attackers to prevent computer accounts from changing
    their password, thus extending the life of Kerberos silver tickets (https://adsecurity.org/?p=2011)
  name: computer_password_change_disabled_registry
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange'
    AND data!=0;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: error_mode_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: per_user_ts_session_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
    Server\fSingleSessionPerUser') WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: powershell_invocationheader_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: bitlocker_encryption_settings_registry_misconfigured
  query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\ShouldEncryptOSDrive'
    OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\OSDriveProtector')
    AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: bitlocker_mbam_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\UseMBAMServices'
    AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of this key if it exists, which it shouldn't by
    default
  name: dns_plugin_dll_registry_exists
  query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll';
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of this key if it exists, which it shouldn't by
    default
  name: error_display_ui_registry_exists
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\PCHealth\ErrorReporting\ShowUI';
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: log_errors_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent'
    AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: subscription_manager_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1'
    AND (data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC'
    AND data!='Server=http://subdomain.domain.com:5985/wsman/SubscriptionManager/WEC');
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: subscription_manager_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager\1')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: command_line_auditing_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled'
    AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: crash_dump_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: error_mode_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Windows\ErrorMode'
    AND data=2;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: log_errors_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\LogEvent')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: winrm_settings_registry_misconfigured
  query: 'SELECT * FROM registry WHERE (path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowBasic''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowCredSSP''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowUnencryptedTraffic''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client\AllowDigest''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowBasic''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowCredSSP''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\AllowUnencryptedTraffic''
    OR path=''HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS\AllowRemoteShellAccess'')
    AND data!=0; '
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: crash_dump_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled'
    AND data=0;
---
apiVersion: v1
kind: query
spec:
  description: Detect a registry based persistence mechanism that allows an attacker
    to specify a DLL to be loaded when cryptographic libraries are called (https://twitter.com/PsiDragon/status/978367732793135105)
  name: physicalstore_dll_registry_persistence
  query: SELECT key, path, name, mtime, username FROM registry r, users WHERE path
    LIKE 'HKEY_USERS\'||uuid||'\Software\Microsoft\SystemCertificates\CA\PhysicalStores\%%'
    OR path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType
    0\CertDllOpenStoreProv\%%' AND name!='#16' AND name!='Ldap';
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: powershell_logging_registry_misconfigured
  query: SELECT * FROM registry WHERE (path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging'
    OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging'
    OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting'
    OR path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableInvocationHeader')
    AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: 'A registry key can be created to disable AMSI on Windows: (https://twitter.com/Moriarty_Meng/status/1011568060883333120)'
  name: amsi_disabled_registry
  query: SELECT key, r.path, r.name, r.mtime, r.data, username from registry r, users
    WHERE path = 'HKEY_USERS\'||uuid||'\Software\Microsoft\Windows Script\Settings\AmsiEnable'
    AND data=0;
---
apiVersion: v1
kind: query
spec:
  description: Controls how often to rotate the local computer password (defaults
    to 30 days). A modification of this value may be an indicator of attacker activity.
  name: computer_maximum_password_age_changed_registry
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge'
    and data!=30;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: dr_watson_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry where key='HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug')
    WHERE key_exists!=2;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: per_user_ts_session_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
    Server\fSingleSessionPerUser' AND data!=1;
---
apiVersion: v1
kind: query
spec:
  description: Registry based persistence mechanism to load DLLs at reboot time and
    avoids detection by Autoruns (https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/).
    Subkeys will be deleted after they run, thus (RunOnce). The RunOnceEx key will
    remain.
  name: runonceex_persistence_registry
  query: SELECT * FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx';
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: smbv1_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: powershell_transcription_logging_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\Transcription\EnableTranscripting')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: powershell_module_logging_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ModuleLogging\EnableModuleLogging')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: powershell_scriptblock_logging_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Powershell\ScriptBlockLogging\EnableScriptBlockLogging')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of the key if it does not match the expected value
  name: bitlocker_mbam_endpoint_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\MDOPBitLockerManagement\KeyRecoveryServiceEndPoint'
    AND data!='https://mbam.server.com/MBAMRecoveryAndHardwareService/CoreService.svc';
---
apiVersion: v1
kind: query
spec:
  description: Returns 0 as a result if the registry key does not exist
  name: command_line_auditing_registry_missing
  query: SELECT IFNULL(key_count,0) AS key_exists FROM (SELECT COUNT(*) AS key_count
    FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ProcessCreationIncludeCmdLine_Enabled')
    WHERE key_exists!=1;
---
apiVersion: v1
kind: query
spec:
  name: smbv1_registry_misconfigured
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1'
    AND data!=0;
---
apiVersion: v1
kind: query
spec:
  description: Returns the content of this key if it exists, which it shouldn't by
    default
  name: send_error_alert_registry_exists
  query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl\SendAlert';
