LoFP LoFP / false positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. for example, event id 1122 is generated when a process attempts to load a dll that is blocked by an asr rule. this can be triggered by legitimate applications that attempt to load dlls that are not blocked by asr rules. this is block only.

Sample rules

Windows Defender ASR Block Events

Description

This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.

Detection logic

`ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Path, Parent_Commandline, Process_Name, ID, EventCode 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_block_events_filter`

Windows Defender ASR Audit Events

Description

This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.

Detection logic

`ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Process_Name, Target_Commandline, Path, ID, EventCode 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_audit_events_filter`

Sample rules

Windows Defender ASR Block Events

Description

This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.

Detection logic

`ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Path, Parent_Commandline, Process_Name, ID, EventCode 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_block_events_filter`

Windows Defender ASR Audit Events

Description

This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.

Detection logic

`ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Process_Name, Target_Commandline, Path, ID, EventCode 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_audit_events_filter`

Windows Defender ASR Registry Modification

Description

The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches.

Detection logic

`ms_defender` EventCode IN (5007) 
| rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" 
| rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" 
| rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" 
| eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") 
| eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") 
| stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID 
| lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule 
| `security_content_ctime(firstTime)`
| rename host as dest 
| `security_content_ctime(lastTime)` 
| `windows_defender_asr_registry_modification_filter`