Techniques
Sample rules
Windows Non-System Process Querying Definition Update
- source: splunk
- technicques:
Description
Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.
Detection logic
`sysmon`
EventID="22"
QueryName="*definitionupdates.microsoft.com*"
NOT Image IN (
"C:\\Program Files\\Microsoft Office\\*",
"C:\\Program Files\\Windows Defender\\*",
"C:\\ProgramData\\Microsoft\\Windows Defender\\*",
"C:\\Windows\\System32\\*",
"C:\\Windows\\SysWOW64\\*"
)
| rename Computer as dest,
Image as process_path
| stats count min(_time) as firstTime
max(_time) as lastTime
by src dest answer answer_count
process_path process_name process_exec process_guid
query query_count QueryResults record_type reply_code_id
signature signature_id user_id vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_non_system_process_querying_definition_update_filter`