Latest Posts

Blocking MCAS Unsanctioned Apps at the Endpoint with MDATP

2020-01-07 0 Comments

*Note Preview Feature

Yes you read that right, its now possible to block unsanctioned apps in Microsoft Cloud App Security directly at your Windows 10 Endpoints. Moving towards a Zero-Trust network away from the corporate firewalls and proxies you still want to maintain network control from the endpoint side, this new feature will give you the possibility to block applications, this is a great step forward in the area and its clear that Microsoft is taking Zero-Trust and Security seriously.

So how to get started first of requirements! Last year we wrote about the Network Block Feature and it could be a good start before reading this article it can be found here. https://blog.sec-labs.com/2019/07/using-wdatp-network-block/

Requirements

  • MDATP and MCAS Integration Enabled
    • MDATP Portal > Settings > Advanced Features
  • Windows 10 with Network Block Enabled
  • MCAS Cloud App Control Enabled
    • MCAS Portal > Settings > Cloud App Control
      • (Its important to note if you have marked apps as unsanctioned in the MCAS Portal already they will automatically be marked as blocked so before turning this on review your unsanctioned apps.)

Configuring Unsanctioned Apps

Once you have your requirements in-place we can start to configure unsanctioned apps, You can either select to maintain this manually or configure a policy to set all apps matching a certain criteria to be blocked. An example could be block all apps with a Risk Score Lower than 3.

Manually

If you go to your Cloud App Dashboard and find the App you want to block just click on the App and select unsanctioned.


Automatically

To have apps marked as unsanctioned automatically can be done with a Policy. Below we have an example of blocking apps that meet the criteria Risk Score 1-3.

Its also possible to add other types of criteria if you want to refine your policy. It all depends what you want to limit and the purpose, is it to control Shadow IT or is it from a Security perspective. Some examples below of other criteria that could be useful depending on the use case.

  • App Category Productivity
  • Daily Traffic Below 5 MB
  • Number of Users Below 5

PRO TIP: When building your Policy its very good that you can play with the Preview Results, that gives you instant feedback on how well your query will perform so try that out.

Back-end Integration

When the unsanctioned app is marked as unsanctioned the back end integration between MCAS and MDATP exchanges data and Custom Indicators are being populated. You can find these under Settings > Indicators > URLs/Domains

Like in this example we did block WhatsApp and that would replicate over to the Indicators in MDATP. The whole flow depending on sync should not take longer than 3 hours. From that you have blocked in MCAS to that the Endpoint has the blocking instruction.

Once its available in MDATP the Endpoints should update their Indicators and should start blocking.

End User Experience

At the moment the end user experience is fairly limited the user would get a Toast Notification that something has been blocked unless you have turned notifications off.

Depending on the App you are trying to communicate with the blocked app/url the behavior would occur differently.

For WhatsApp it would look like this when Launching it (sorry message in Swedish)

And a Default Notification Message like this below

Reporting

At the moment the tracking and reporting is also limited to whats available in MCAS and MDATP and its supported retention times.

Future Asks

Things I want to see and I have fed back to the Product groups I want this to evolve to going forward.

  • Support for X-Platform Devices
  • Block without Alerting like Block and Report
  • Having the possibility to do Exclusions and Custom Targeting of Devices/Users
  • Expand this to URL Categories Block / Monitor
  • Better Historical Reporting
  • Customize Messages
  • End User Coaching
  • End User Exclusion Request

If you have other ideas feel free to tweet me at @stefanschorling and I will relay.

Detect, Protect, Security

New Threat & Vulnerability Management capabilities in Defender ATP

2019-11-08 0 Comments

Microsoft announces the following new capabilities that will go into public preview this month:

  • Vulnerability Assessment (VA) support for Windows Servers 2008 R2 and above
  • Integration with ServiceNow for improved IT/Security communication
  • Advanced hunting across vulnerabilities and security alerts
  • Role-based access controls (RBAC) for teams focusing on vulnerability management
  • Automated user-impact analysis

The ServiceNow integration is very easy. Just follow the guide in the settings tab

This feature provides one-click remediation request via Service Now to other IT teams.

TVM capabilities – Let’s use in hunting 🙂

TVM hunting

RBAC – more granular control

Defender ATP rbac

Happy Hunting!

Detect, Protect

, ,

Defender ATP EDR for MAC preview

2019-11-07 0 Comments

During Microsoft Ignite, Microsoft announced Defender ATP EDR capabilities for Mac is available in preview.

It’s great to see Microsoft extends the EDR capabilities to cross-platform

  1. Rich investigation experience – including machine timeline, process creation, file creation, network connections and, of course, the popular Advanced Hunting.
  2. Optimized performance – enhanced CPU utilization in compilation procedures and large software deployments.
  3. In-context AV detections – just like with Windows, get insight into where a threat came from and how the malicious process or activity was created.

More information available at
https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Microsoft-Defender-ATP-for-Mac-EDR-in-Public-Preview/ba-p/985879

Happy Hunting!

Detect, News, Security

, , ,

Defender ATP to Linux – available next year

2019-11-05 0 Comments

During Ignite Microsoft announces Defender ATP for Linux is coming next year

Extending Defender ATP to be able to natively support Windows, Mac and Linux is great news and will simplify advanced threat management across the environment.

Happy Hunting!

Detect, News

, ,

Microsoft announces new innovations in security, compliance, and identity at Ignite

2019-11-04 0 Comments

This far in the Microsoft Ignite Conference, Microsoft have made new announcements.

This list is a mix of some of the announcements made:

Azure Sentinel New connectors, Zscaler, Barracuda, and Citrix. They have also added new hunting queries and machine learning-based detections to assist in prioritizing the most important events.

Insider Risk Management in Microsoft 365 – to help identify and remediate threats stemming from within an organization. Now in private preview, this new solution leverages the Microsoft Graph along with third-party signals, like HR systems, to identify hidden patterns that traditional methods would likely miss. https://www.microsoft.com/en-us/microsoft-365/blog/?p=233542

Microsoft Authenticator Microsoft makes Microsoft Authenticator available to customers as part of the Azure Active Directory (Azure AD) free plan. Deploying Multi-Factor Authentication (MFA) reduces the risk of phishing and other identity-based attacks by 99.9 percent.

Microsoft Defender Advanced Threat Protection (ATP)—Microsoft extends endpoint detection and response capability in Microsoft Defender ATP to include MacOS, now in preview. Microsoft also plans to add support for Linux servers.

Azure Security Center—Microsoft announces new capabilities to find misconfigurations and threats for containers and SQL in IaaS while providing rich vulnerability assessment for virtual machines. Azure Security Center also provides integration with security alerts from partners and quick fixes for fast remediation.

Microsoft information protection and governance—The compliance center in Microsoft 365 now provides the ability to view data classifications categorized by sensitive information types or associated with industry regulations. Machine learning also allows you to use your existing data to train classifiers that are unique to your organization, such as customer records, HR data, and contracts.

Microsoft information protection and governance—The compliance center in Microsoft 365 now provides the ability to view data classifications categorized by sensitive information types or associated with industry regulations. Machine learning also allows you to use your existing data to train classifiers that are unique to your organization, such as customer records, HR data, and contracts.

Microsoft Compliance Score—Now in public preview, Microsoft Compliance Score helps simplify regulatory complexity and reduce risk. It maps your Microsoft 365 configuration settings to common regulations and standards, providing continuous monitoring and recommended actions to improve your compliance posture.  Microsoft also introduces a new assessment for the California Consumer Privacy Act (CCPA).

For the full list see:

https://www.microsoft.com/security/blog/2019/11/04/microsoft-announces-new-innovations-in-security-compliance-and-identity-at-ignite/?fbclid=IwAR0Fa1YHBV2GfqxGaxzOVUsSLQEHvlR5CFAhvoQziJ9I-mnmsolnRiY0qbk

News, Uncategorized

,

Hunting for MiniNt security audit block in registry

2019-10-15 1 Comment

Another day in the Advanced Hunting feature.

I was told about a twitter post which explained it’s possible to block Security events from being created.

If the following key is added:
HKLM\System\CurrentControlSet\Control\MiniNt

Event Viewer after the registry key was added and after a reboot

Since it’s registry we have a lot of data to query in the Defender ATP portal (https://securitycenter.windows.com)

The Hunting query will be as follows

// Mattias Borg
// @mattiasborg82
RegistryEvents 
| where (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt") or
        (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MiniNt")
| sort by EventTime desc
| project EventTime, ComputerName, RegistryKey, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessSHA1

This is the initial hunting query and might be changed to avoid False-Positives if there are any.

To be able to create a custom detection rule we need to add “MachineId” and “ReportId” to the output.

// Mattias Borg
// @mattiasborg82
RegistryEvents 
| where (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNt") or
        (RegistryKey  == "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MiniNt")
| sort by EventTime desc
| project EventTime, ComputerName, RegistryKey, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessSHA1, MachineId, ReportId

Click on “Create a detection rule”

create detection rule

Fill in the form and select your preferred actions

defender atp custom rule

Happy Hunting!

Detect

, , ,

Azure Sentinel is now GA

2019-09-25 0 Comments

Azure Sentinel—the cloud-native SIEM that empowers defenders is now generally available

azure sentinel

Some of the new features are:

  • Workbooks are replacing dashboards, providing for richer analytics and visualizations
  • New Microsoft and 3rd party connectors

Detection and hunting:

  • Out of the box detection rules: The GitHub detection rules are now built into Sentinel.
  • Easy elevation of MTP alerts to Sentinel incidents.
  • Built-in detection rules utilizing the threat intelligence connector.
  • New ML models to discover malicious SSH access, fuse identity, and access data to detect 35 unique threats that span multiple stages of the kill chain. Fusion is now on by default and managed through the UI
  • Template playbooks now available on Github.
  • New threat hunting queries and libraries for Jupyter Notebooks

Incidents:

  • The interactive investigation graph is now publicly available.
  • Incidents support for tagging, comments, and assignments, both manually and automatically using playbooks.

MSSP and enterprise support:

  • Azure Lighthouse for multi-tenant management
  • RBAC support

For further information:

Pricing: https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/
Product page: https://azure.microsoft.com/en-us/services/azure-sentinel/
Documentation: https://docs.microsoft.com/en-us/azure/sentinel/

Happy Hunting

Detect, Events, Respond, Security

, , , ,

Gartner EPP Magic quadrant 2019 – Defender in the leading quadrant

2019-08-23 0 Comments

The 2019 version of the Gartner Magic Quadrant clearly shows that Microsoft is in the game to provide extremely powerfull Endpoint protection platform (EPP).
Microsoft is named a leader!

With built-in powerful capability which ties to Protect, Detect and respond, they have given us great tools for our security work.

Microsoft is unique in the EPP space, as it is the only vendor that can provide built-in endpoint protection capabilities tightly integrated with the OS. Windows Defender Antivirus (known as System Center Endpoint Protection in Window 7 and 8) is now a core component of all versions of the Windows 10 OS, and provides cloud-assisted attack protection.

Microsoft Defender Advanced Threat Protection (ATP) provides an EDR capability, monitoring and reporting on Windows Defender Antivirus and Windows Defender Exploit Guard (“Exploit Guard”), vulnerability and configuration management, as well as advanced hardening tools.

The Microsoft Defender ATP incident response console consolidates alerts and incident response activities across Microsoft Defender ATP, Office 365 ATP,
Azure ATP and Active Directory, as well as incorporates data sensitivity from Azure information protection.

Microsoft is much more open to supporting heterogeneous environments and has released EPP capabilities for Mac. Linux is supported through partners, while native agents are on the roadmap.

Microsoft has been placed in the Leaders quadrant this year due to the rapid market share gains of Windows Defender Antivirus (Defender), which is now the market share leader in business endpoints.

In addition, excellent execution on its roadmap make it a credible replacement for competitive solutions, particularly for organizations looking to reduce complexity.

Gartner

The benefit of the insights and protection these tools, and ability to use built-in SOAR capabilities, gives security teams around the globe a better and much faster understanding of the attacks for much fast response.

Many features like Exploit Protection, Network Protection, Attack Surface reduction, Firewall and more will provide a more reliable platform which is easy to manage.

The enriched alerts and incidents gives security teams a chance to put their effort to the critical incidents and avoid spending time trying to fight the noice in all different tools and manual tasks.

Automated investigations

Build your playbooks

Take back the control with live response

We also have the threat and vulnerability management feature which gives you visibility on vulnerable software in your estate

Threat hunting

Full gartner report:
https://www.gartner.com/doc/reprints?id=1-1OCBC1P5&ct=190731&st=sb&fbclid=IwAR3G9Otpxuc52bi0hpFE4-iGv8uhvgnxtSl0boqAU7-R4aw5MyLsuyy0fLg

Congratulations Microsoft, we’re looking forward for all coming features

Happy Hunting!

Detect, Identify, Protect, Respond

, , , , ,

Using WDATP Network Block

2019-07-23 2 Comments

When working with Incident Response you from time to time find artifacts that you need to block, IP Addresses or specific URLs. Instead of doing this on the proxies or firewalls its often more efficient to do this on the endpoint level to catch roaming machines where ever they are. In some cases you also work with other TI vendors and get IPs and URLs you want to block and build automation around. This feature is currently in preview

So, with WDATP you can now block or allow IPs and Urls.

For this feature to work you need to have some prerequisites

  • Windows 10 1709 Pro, E3/E5 or Edu
  • Windows Defender Network Protection
  • Windows Defender AV
  • Cloud Delivered Protection Enabled

It’s possible to enable Network Protection in several ways

  • PowerShell
  • Group Policy
  • System Center Configuration Manager
  • Intune / MDM

For detailed steps for each method

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection

In our case we will just leverage PowerShell. To set and verify its configured

Set-MpPreference -EnableNetworkProtection Enabled

Get-MpPreference | fl

Once you have prepared the endpoint you can go to the  MDATP Portal and add your IPs/URLs

  1. Navigate to Settings > Rules > Indicators.
  2. Select the IP Address tab to view the list of IP’s.
  3. Select the URLs/Domains to view the list of URLs/domains.

In this tutorial we will Add a URL but the same procedure would apply for an IP.

1. Click on Add Indicator

2. Enter a url and select if you want the block to expire

3. Add an Action as you like and descriptive texts as you want to have with your alerts. In this case we want to block and get an alert for this.

4. Select Scope, in this case we will select all machines but if you have built a structure with Machine Groups you can select to target specific machine groups where this will apply.

5. On the Summary screen click Save.

Note: from entering an IP/URL it can take some time for it to propagate to the endpoints and when it comes to removal it may even take a bit longer.

So when this has propagated to the endpoints we can test it out and see how this looks on the endpoint.

When browsing to the URL the end user will be notified about that something is blocked with a toast notification and an event log entry will also be logged.

If you want to customize the toast notifications for Windows Defender you can do that with updated group policy templates more information on that here. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications

To create a custom view in event viewer use this url reference.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard

In our case an alert will also be triggered in in the MDATP console as well where we can continue our investigation. I hope this gave a little valuable insight on this feature.

Detect, Protect, Security

MDATP Investigation behind forward proxy

2019-07-23 0 Comments

There are still many companies using forward proxies and when analyzing traffic from endpoints this can be a bit challenging. This due to that the client connects to the forward proxy instead of the public endpoint like http://blog.sec-labs.com.

So instead of the public endpoint you would see that the process is connecting to the proxy.

Microsoft have engineers around this and by enabling the Network Protection feature in either Audit Mode or Block mode you can now see the public endpoint the process is actually communicating with behind the forward proxy.

Events that is coming from this type of detection is flagged with the a “NetworkProtection” tag.

If you want to use thees events generated when you do Hunting they are found under Network CommunicationEvents and if you know your proxy ip address you can get everything that has gone via the proxy with the following query.

NetworkCommunicationEvents

| where ActionType == “ConnectionSuccess” and RemoteIP != “ProxyIP” 

If you want to enable Network Protection the below link will guide you through the different ways you can enable it. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection

Happy Hunting

Detect, Protect, Security