edr:elastic-defend registry
registry
Stands in for win:sysmon 12 (full), win:sysmon 13 (full)
- Log source
- Elastic Defend endpoint events
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Elastic Agent with the Elastic Defend integration; datasets logs-endpoint.events.*.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Elastic 63
Why this tier
ATT&CK via equivalence to win:sysmon 12; ATT&CK via equivalence to win:sysmon 13
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 63
- Code Signing Policy Modification Through Registry
- Component Object Model Hijacking
- Creation of a Hidden Local User Account
- Creation or Modification of Root Certificate
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Elastic Defend Alert Followed by Telemetry Loss
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- Image File Execution Options Injection
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Local Account TokenFilter Policy Disabled
- Microsoft Windows Defender Tampering
- Modification of AmsiEnable Registry Key
- Modification of WDigest Security Provider
- Netsh Helper DLL
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Outlook Home Page Registry Modification
- Persistence via Hidden Run Key Detected
- Persistence via WMI Standard Registry Provider
- Persistence via a Windows Installer
- Port Forwarding Rule Addition
- Potential ClickFix Command via Windows Run Dialog
- Potential Evasion via Boot Time Removal Tool
- Potential FileFix Command via Windows Explorer Address Bar
- Potential LSA Authentication Package Abuse
- Potential NetNTLMv1 Downgrade Attack
- Potential Persistence via Time Provider Modification
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Privilege Escalation via Service ImagePath Modification
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential RemoteMonologue Attack
- Potential SharpRDP Behavior
- Potential Uninstall Entry Concealment
- PowerShell Script Block Logging Disabled
- Privilege Escalation via Windir Environment Variable
- RDP Enabled via Registry
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Scheduled Task Creation
- SIP Provider Modification
- Scheduled Task Created by a Windows Script
- Scheduled Tasks AT Command Enabled
- Service Disabled via Registry Modification
- Service Path Modification
- SolarWinds Process Disabling Services via Registry
- Startup or Run Key Registry Modification
- Suspicious ImagePath Service Creation
- Suspicious Print Spooler Point and Print DLL
- Suspicious Startup Shell Folder Modification
- Uncommon Registry Persistence Change
- Unusual Persistence via Services Registry
- Werfault ReflectDebugger Persistence
- Windows Defender Disabled via Registry Modification
- Windows Installer with Suspicious Properties
- Windows Subsystem for Linux Distribution Installed