Techniques
Sample rules
Windows Defender ASR Block Events
- source: splunk
- technicques:
Description
This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves.
Detection logic
`ms_defender`
EventCode IN (
1121,
1126,
1129,
1131,
1133
)
| fillnull value=NULL
| stats count min(_time) as firstTime
max(_time) as lastTime
by host EventCode
Parent_Commandline Process_Name Target_Commandline
Path ID RuleType
| lookup local=t asr_rules ID OUTPUT ASR_Rule
| rename host as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_defender_asr_block_events_filter`
Windows Defender ASR Audit Events
- source: splunk
- technicques:
Description
This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.
Detection logic
`ms_defender`
EventCode IN (
1122,
1125,
1132,
1134
)
| fillnull value=NULL
| stats count min(_time) as firstTime
max(_time) as lastTime
by host EventCode
Parent_Commandline Process_Name Target_Commandline
Path ID RuleType
| lookup local=t asr_rules ID OUTPUT ASR_Rule
| rename host as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_defender_asr_audit_events_filter`