Split registry_event category

[frack113]

Hello,
I have working on splitting registry_event

Sysmon schema	Eventid	Sigma category	Observation
SYSMON_REG_KEY	12	registry_add	Registry object added
SYSMON_REG_KEY	12	registry_delete	Registry object deleted
SYSMON_REG_SETVALUE	13	registry_set	Registry value set
SYSMON_REG_NAME	14	registry_rename	Registry object renamed
	12-14	registry_event	any event link to registry

Think the new category name are fine.
In a first time many will stay with registry_event, because I need to read the references to check what was researched precisely.

PR : #2855

[Neo23x0]

If Event ID 12 is "add" or "delete" and nor just "access" = "read" then I'd use "registry_modify" instead.
It's a bit problematic that Sysmon puts "add" and "delete" in the same Event ID.
I'd split them up and make "registry_add" and "registry_delete". We could then map rules for both our event types to Sysmon ID 12.

[frack113]

I have update the table with add and delete.

[Neo23x0]

I'd guess 97% of the rules that we have are meant and written for registry_set / registry_add

[frack113]

registry_add	registry_delete	registry_set	registry_rename	registry_event
6	3	79	0	39
5%	2%	63%	0%	30%

registry_rename exist but in complex registry_event rules (like create or rename)

[frack113]

Why not put all the registry_* in a registry folder like powershell ?