LoFP LoFP / false positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. for example, event id 1122 is generated when a process attempts to load a dll that is blocked by an asr rule. this can be triggered by legitimate applications that attempt to load dlls that are not blocked by asr rules. this is block only.

Sample rules

Windows Defender ASR Block Events

Description

This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.

Detection logic

`ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Path, Parent_Commandline, Process_Name, ID, EventCode, ASR_Rule 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_block_events_filter`

Windows Defender ASR Audit Events

Description

This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.

Detection logic

`ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Process_Name, Target_Commandline, Path, ID, EventCode, ASR_Rule 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_audit_events_filter`

Sample rules

Windows Defender ASR Block Events

Description

This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.

Detection logic

`ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Path, Parent_Commandline, Process_Name, ID, EventCode, ASR_Rule 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_block_events_filter`

Windows Defender ASR Audit Events

Description

This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.

Detection logic

`ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) 
| lookup asr_rules ID OUTPUT ASR_Rule 
| fillnull value=NULL 
| stats count min(_time) as firstTime max(_time) as lastTime by host, Process_Name, Target_Commandline, Path, ID, EventCode, ASR_Rule 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| rename host as dest 
| `windows_defender_asr_audit_events_filter`

Windows Defender ASR Registry Modification

Description

This detection searches for Windows Defender ASR registry modification events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR registry modification events that are generated when a process or application attempts to modify a registry key that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned.

Detection logic

`ms_defender` EventCode IN (5007) 
| rex field=New_Value "0x(?<New_Registry_Value>\\d+)$" 
| rex field=Old_Value "0x(?<Old_Registry_Value>\\d+)$" 
| rex field=New_Value "Rules\\\\(?<ASR_ID>[A-Fa-f0-9\\-]+)\\s*=" 
| lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule 
| eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") 
| eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") 
| stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_Rule 
| `security_content_ctime(firstTime)`
| rename host as dest 
| `security_content_ctime(lastTime)` 
| `windows_defender_asr_registry_modification_filter`