Microsoft-Defender-Security-Center-Hunting-Queries

KO | EN

gitlite — search

#python #hacktoberfest #react #ai #golang #android #machine-learning #deep-learning #macos #awesome #kubernetes #mcp #ios #open-source

Microsoft-Defender-Security-Center-Hunting-Queries

(★ 40)

Hunting Queries for Microsoft Defender Security Center https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview

Microsoft-Defender-Security-Center-Hunting-Queries Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Advanced hunting queries for Microsoft Defender Security Center
This repo contains some personal [queries](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) I developed for MS Defender Security Center for known threats

Hope can be useful. If you find any FP or you want suggest some modification please send a PR

## LOLBAS
Detection queries based on [Living Off The Land Binaries and Scripts (LOLBAS)](https://lolbas-project.github.io/) criteria

### Certutil.exe
[Certutil.exe](https://lolbas-project.github.io/lolbas/Binaries/Certutil/) is a Windows binary used for handeling certificates; the query detects download and encode/decode operations
```
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName == "CertUtil.exe"
| where ProcessCommandLine contains "://" or ProcessCommandLine contains "-encode" or ProcessCommandLine contains "-decode"
```

## Red Canary - detection of Ryuk ransomware
Detection opportunities highlighted in Red Canary blog post [A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak](https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/)

### Detection Opportunity 1: Process hollowing of cmd.exe
```
DeviceProcessEvents
| where InitiatingProcessFileName == "cmd.exe"
| where ProcessCommandLine matches regex "^$"
| where FileName has_any("net.exe", "explorer.exe", "nltest.exe")
```

### Detection Opportunity 2: Enumerating domain trusts activity with nltest.exe
```
DeviceProcessEvents
| where FileName == "nltest.exe"
| where ProcessCommandLine has_any("/dclist:", "/domain_trusts", "/all_trusts")
```

### Detection Opportunity 3: Enumerating domain admins with net group
```
DeviceProcessEvents
| where FileName == "net.exe"
// exclude local PC groups enumeration from the results, can generate FP
// e.g. you have hits for local groups when Defender ATP collects the investigation package
| where ProcessCommandLine !contains "localgroup"
| where ProcessCommandLine contains "group"
```

### Detection Opportunity 4: Process hollowing of explorer.exe
```
DeviceProcessEvents
| where FileName == "svchost.exe"
| where InitiatingProcessFileName !in ("services.exe", "MsMpEng.exe")
// exclude from the search parent process svchost.exe with -k option
| where not(InitiatingProcessFileName == "svchost.exe" and InitiatingProcessCommandLine contains "-k")
```
TODO: I see some False Positive, try to improve the search

```
DeviceProcessEvents
| where FileName == "svchost.exe"
| where ProcessCommandLine matches regex "^$"
// exclude from the search parent process svchost.exe with -k option
| where not(InitiatingProcessFileName == "svchost.exe" and InitiatingProcessCommandLine contains "-k")
```

### Detection Opportunity 5: Attempted lateral movement via WMI + PowerShell + Cobalt Strike
```
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine contains "-encodedcommand"
```

```
DeviceProcessEvents
| where FileName == "powershell.exe"
| where InitiatingProcessFileName == "cmd.exe"
| where InitiatingProcessParentFileName == "wmiprvse.exe"
```

### Detection Opportunity 6: Lateral movement via Cobalt Strike’s SMB PsExec module
```
DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine matches regex "^$"
```
TODO: implemnent connection check for the process

### Detection Opportunity 7: Enumerating enterprise administrator accounts
Check Detection Opportunity 3

### Detection Opportunity 10: Adfind extracting information from Active Directory
```
DeviceProcessEvents
| where FileName == "adfind.exe"
```

## Vitali Kremez - detection of Ryuk ransomware
Detection steps highlighted in Vitali Kremez blog post [Anatomy of Attack: Inside BazarBackdoor to Ryuk Ransomware "one" Group via Cobalt Strike](https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike)

### Step 4: Review the network of the host via "net view"
```
DeviceProcessEvents
| where FileName == "net.exe"
| where ProcessCommandLine contains "view"
// exclude FP
| where ProcessCommandLine !contains "vmware-view-usbd"
```

### Step 13: Grant net share full access to all for Ryuk ransomware
```
DeviceProcessEvents
| where FileName == "net.exe"
| where ProcessCommandLine has "share" and ProcessCommandLine contains "GRANT"
```
Check for a GRANT; on the post Vitali shows a FULL access to Everyone ```net share aaa$=C:\aaa /GRANT:Everyone,FULL```

# FireEye - Back in a Bit: Attacker Use of the Windows Background Intelligent Transfer Service
Detection of bitsadmin.exe usage to download malware and create persistence as shown in FireEye post [Back in a Bit: Attacker Use of the Windows Background Intelligent Transfer Service](https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html)

### bitsadmin download activity
```
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName == "bitsadmin.exe"
| where ProcessCommandLine contains "/addfile"
```
Check using bitsadmin to create a job that downloads an executable (malware) and stores it somewhere

### bitsadmin create a persistent job activity
```
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName == "bitsadmin.exe"
| where ProcessCommandLine contains "/SetNotifyCmdLine"
```
Check using bitsadmin to create a job to gain persistence

Microsoft-Defender-Security-Center-Hunting-Queries

Microsoft-Defender-Security-Center-Hunting-Queries Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Microsoft-Defender-Security-Center-Hunting-Queries

Microsoft-Defender-Security-Center-Hunting-Queries Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README