Tag Archive: Kusto

Advanced Hunting – Defender ATP – Squirrel

Security Labs 2019-07-02 0 Comments

When working with Advanced Hunting in Defender ATP, you tend to always want to update your queries as you learn. You will probably also notice that sometimes your query wasn’t broad enough or all information was not available at the time. And sometimes you just want to make it look better for others to use in a shared environment.

We have updated the Squirrel hunting query to adjust to more parameters which can be used. we simple remove the check for a parameter and focus on the http part instead.

There are also some legit domains which are used by some of the applications, slack and discord to mention some of them.

ProcessCreationEvents
| where (ProcessCommandLine has "update.exe") or (ProcessCommandLine has "squirrel.exe")
| where (ProcessCommandLine contains "http")
| extend URL=extract(@"((http:|https:)+[^\s]+[\w])", 1, ProcessCommandLine)
| where URL !in ("https://slack.com/desktop/update/windows_x64", "https://discordapp.com/api/updates/stable")
| sort by EventTime desc 
| project EventTime, 
          ComputerName,
          URL,
          FolderPath, 
          ProcessCommandLine, 
          AccountName, 
          InitiatingProcessCommandLine, 
          ReportId, 
          ProcessId, 
          InitiatingProcessId

Happy Hunting!

Detect

Defender ATP, Kusto

Hunt for nuget/Squirrel update vulnerability

Security Labs 2019-07-01 0 Comments

A few days ago, a post on medium stated that an arbitrary code execution was possible in Squirrel which affected Teams and other applications which used Squirrel and Nuget for updates.

https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12

In the post, Teams is mentioned as example but other affected application were mentioned on twitter.

So, to see what our environment is up to with regards to this. Our favorite place to go to: Defender ATP – Advanced Hunting!

To explain the query, since there are other apps than teams which uses Squirrel, we aim to keep the query as broad as we can.

Since some applications uses Squirrel and web for updates we can’t simply say that all web requests are malicious. But we have done some verification and discovered many apps vulnerable to this.

To make it more easy to overview we’re adding the URL to a column

To continue this we can count unique URL’s to find anomalies

Edit: An Updated Query can be found on the link below here http://blog.sec-labs.com/2019/07/advanced-hunting-defender-atp-squirrel/

ProcessCreationEvents
| where ProcessCommandLine has "update.exe"
| where (ProcessCommandLine contains "http") and (ProcessCommandLine contains "--update")
| extend exeURL = case(ProcessCommandLine has "=",split(ProcessCommandLine, "=", 1), 
                       ProcessCommandLine !has "=", split(ProcessCommandLine, "--update ",1), 
                       "Default")
| where exeURL != "Default"
| sort by EventTime desc 
|project EventTime, 
          ComputerName,
          exeURL,
          FolderPath, 
          ProcessCommandLine, 
          AccountName, 
          InitiatingProcessCommandLine, 
          ReportId, 
          ProcessId, 
          InitiatingProcessId

Defender Application Control would definitely block this attack and other mitigations in operating system will harden the clients in your environment.

Happy Hunting!

Detect, Respond, Security, Uncategorized

AdvancedThreatProtection, Defender ATP, Kusto, Nuget, Teams, ThreatHunting, Vulnerability

Hunting Windows Defender Exploit Guard with ATP

Security Labs 2019-04-11 0 Comments

Alright, since I happen to be in a blog mode I keep the posts coming.

This post continue to explore the hunting capatibilities in Defender ATP by query for Exploit Guard detections.

So what’s this Exploit Guard?

Windows Defender Exploit Guard is a new set of intrusion prevention capabilities which are built-in with Windows 10, 1709 and newer versions.

Exploit Guard consists of 4 components which are designed to lock down the device against a wide variety of attack vectors and block behaviors commonly used in malware attacks, while enabling enterprises to balance their security risk and productivity requirements

Component	Details
Attack Surface Reduction (ASR)	A set of controls that enterprises can enable to prevent malware from getting on the machine by blocking Office-, script-, and email-based threats
Network Protection	Protects the endpoint against web-based threats by blocking any outbound process on the device to untrusted hosts/IP through Windows Defender SmartScreen
Controlled Folder Access	Protects sensitive data from ransomware by blocking untrusted processes from accessing your protected folders
Exploit Protection	A set of exploit mitigations (replacing EMET) that can be easily configured to protect your system and applications

Example of ASR rules

• Block Office apps from creating executable content
• Block Office apps from launching child process
• Block Office apps from injecting into process
• Block Win32 imports from macro code in Office
• Block obfuscated macro code

Exploit Guard is configured through MDM (Intune) or SCCM or GPO’s or PowerShell.

If you have Microsoft 365 E5 license or Threat Protection license package, you don’t have to use Windows Event Forward to get the events in a central log solution. They will automatically be forwarded to your Microsoft 365 security portal https://security.microsoft.com where you have a nice looking dashboard where you can see alerts and configurations of ASR and other things.

This following dashboard is a part from the Monitor and Report section in the portal

Back to Defender ATP and the hunting which this post was supposed to be all about.

We have published some posts now about hunting custom alerts.

In the query console in Defender ATP we started to go backwards to find the ASR events. It’s simple. configure your client, run a few attacks which will trigger the alerts.

We looked in the MiscEvents for all events (filtered on computername and time). Which gaves us ideas of ActionTypes to use in the query.

Examples from the output:

AsrOfficeMacroWin32ApiCallsAudited

AsrPsexecWmiChildProcessBlocked

ControlledFolderAccessViolationBlocked

ExploitGuardAcgAudited

ExploitGuardChildProcessAudited

ExploitGuardNetworkProtectionBlocked

ExploitGuardNonMicrosoftSignedAudited

ExploitGuardWin32SystemCallBlocked

SmartScreenAppWarning

SmartScreenUrlWarning

SmartScreenUserOverride

Interesting note “SmartScreenUserOverride” is a separate event which you can query

When we had the raw Actiontypes we created the query to cover as much as we could.

//Happy Hunting
MiscEvents 
| where ActionType contains "asr" or
        ActionType contains "Exploit" or
        ActionType contains "SmartScreen" or
        ActionType contains "ControlledFolderAccess"
| extend JsonOut = parse_json(AdditionalFields)
| sort by EventTime desc 
| project EventTime, ComputerName, InitiatingProcessAccountName, ActionType,  
         FileName, FolderPath, RemoteUrl, ProcessCommandLine, InitiatingProcessCommandLine,
         JsonOut.IsAudit,JsonOut.Uri,JsonOut.RuleId,JsonOut.ActivityId

We are also parsing AdditionalFields to be able to add extra value to events which contained such data.

From this point we can do additional filters. For example, if you want to enable ASR enterprise wide, set them in auditmode and report on the alerts without affect user productivity, remediate and the do a enterprise wide block enrollment

Happy Hunting!

Detect, Identify, Uncategorized

ASR, ATP, CFA, Defender, ExploitGuard, Kusto, MDATP, SmartScreen, WDATP, WDEG

Microsoft Security—a Leader in 5 Gartner Magic Quadrants 2019-12-03
Gartner has named Microsoft Security a Leader in five Magic Quadrants, which demonstrates balanced progress and effort in all execution and vision categories. The post Microsoft Security—a Leader in 5 Gartner Magic Quadrants appeared first on Microsoft Security.
Spear phishing campaigns—they’re sharper than you think 2019-12-02
Spear phishing campaigns can be highly effective—but they aren’t foolproof. If you understand how they work, you can put measures in place to reduce their power. The post Spear phishing campaigns—they’re sharper than you think appeared first on Microsoft Security.
Gartner Names Microsoft a Leader in the 2019 Enterprise Information Archiving (EIA) Magic Quadrant 2019-11-26
In Gartner’s annual Magic Quadrant for Enterprise Information Archiving (EIA), Microsoft was named a Leader again. The post Gartner Names Microsoft a Leader in the 2019 Enterprise Information Archiving (EIA) Magic Quadrant appeared first on Microsoft Security.
Insights from one year of tracking a polymorphic threat 2019-11-26
We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in […]
Going in-depth on the Windows 10 random number generation infrastructure 2019-11-25
We are happy to release to the public The Windows 10 random number generation infrastructure white paper, which provides details about the Windows 10 pseudo-random number generator (PRNG) infrastructure, and lists the primary RNG APIs. The whitepaper also explains how the entropy system works, what the entropy sources are, and how initial seeding works. The […]
Rethinking cyber learning—consider gamification 2019-11-25
Gamified cybersecurity solutions offer immense promise by giving users practical, hands-on opportunities to learn by doing. Microsoft and Circadence are partnering to deliver Azure-hosted cyber range learning solutions for beginners up to advanced SecOps pros. Gamification is an increasingly important way for enterprises to attract tomorrow’s cyber pro talent and create tailored learning and more […]
Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1 2019-11-14
A series on DART’s tools, techniques, and procedures for investigating cybersecurity incidents at their customer organizations. Part 1 introduces the team and gives a brief overview of the tools that DART utilizes. The post Changing security incident response by utilizing the power of the cloud—DART tools, techniques, and procedures: part 1 appeared first on Microsoft […]
Zero Trust strategy—what good looks like 2019-11-11
Zero Trust is a model that will ultimately be infused throughout your enterprise and should inform virtually all access decisions and interactions between systems. The post Zero Trust strategy—what good looks like appeared first on Microsoft Security.
Microsoft works with researchers to detect and protect against new RDP exploits 2019-11-07
The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check. The post Microsoft works with researchers to detect and protect against new RDP exploits appeared first on Microsoft Security.
Microsoft Cloud Security solutions provide comprehensive cross-cloud protection 2019-11-06
Microsoft Cloud Security is a comprehensive set of security solutions that protects every layer of your cross-cloud resources. The post Microsoft Cloud Security solutions provide comprehensive cross-cloud protection appeared first on Microsoft Security.