Techniques
Sample rules
Windows Defender Threat Detected on Kernel Object Path
- source: splunk
- technicques:
Description
The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot). It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender’s own scanning pipeline for local privilege escalation.
Detection logic
`ms_defender`
EventCode IN (1116, 1117)
Path="*\\globalroot\\*"
| fillnull
| stats count min(_time) as firstTime
max(_time) as lastTime
values(EventCode) as EventCode
values(Action_Name) as Action_Name
values(Additional_Actions_String) as Additional_Actions_String
values(FWLink) as FWLink
by dvc Detection_User Path Threat_Name Severity_Name Category_Name
| rename dvc as dest, Detection_User as user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_defender_threat_detected_on_kernel_object_path_filter`