Critical System Protection

 View Only
  • 1.  Creation/deletion/modification of Registry keys as Writable Resource Lists

    Posted Feb 14, 2013 11:06 AM

     

    Hi there.
     
    Playing around with prevention policies in SCSP v.5.2.9 I've found very weird behavior with registry keys. What I want to see is any creation, deletion or modification in registry keys/subkeys, however I cannot find a common pattern.
     
    Adding the following entry in == Global Policy Options --> Registry Rules --> Writable Resoure Lists --> Allow but log modifications to these Registry Keys==, works as I expect, I see the events for creation, deletion and modification of keys/subkeys.
     
    HKEY_LOCAL_MACHINE\System\*ControlSet*\Services\LanManServer\Parameters*
     
    But doing exactly the same, but different registry key, doesn't behave in the same way. Then I started playing with the "*" and "\" characters, and the results are definitively unexpected.
     
    If I use any of the following entries, the creation and deletion of keys/subkeys are reported, but no modification.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR*
    HKEY_LOCAL_MACHINE\SYSTEM\*CurrentControlSet*\services\USBSTOR*
    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR\*
     
    Any other "combination" would result in reporting just the creation or just the deletion of the key/subkey; in the worst case, nothing gets reported.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR\  --> [key creation reported]
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR\* --> [key deletion reported]
    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR  --> [nothing reported]
    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR*  --> [nothing reported]
     
    Does anyone see any "predictable" pattern here? Am I missing something?
     
    Cheers.

     



  • 2.  RE: Creation/deletion/modification of Registry keys as Writable Resource Lists

    Posted Feb 15, 2013 03:46 AM

     

    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR  --> [nothing reported]
    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR*  --> [nothing reported]
     
    I can understand why these 2 wouldnt report as they are both incomplete registry locations,  Am I right in saying that if you use USBSTOR\* that key creation DOESN'T get reported, only deletion?  And the same the other way round? for USBSTOR\ ?
     
     


  • 3.  RE: Creation/deletion/modification of Registry keys as Writable Resource Lists

    Posted Feb 15, 2013 08:27 AM

    Hi Alex_CST. Thanks for your reply.

    You're right on saying so. 

    USBSTOR\  --> [key creation reported]

    USBSTOR\* --> [key deletion reported]
     
    Does that make sense? 
     
    For USBSTOR\*, I've seen two cases, Nothing Reported and Deletion and Creation reported. As I can see, the difference is the "\" in the beggining of the path. 
     
    However what I was originally trying to achieve was to see the creation, MODIFICATION and deletion of keys. So far, I'm unable to find the correct "syntax" to get the MODIFICATION events reported in the console. Any thoughts?