Merge branch 'bypass-win-defender2' into 'develop'

bypass-win-defender2

See merge request threat-research/security_content!1335

detections/endpoint/windows_impair_defense_disable_pua_protection.yml

@@ -0,0 +1,73 @@
+name: Windows Impair Defense Disable PUA Protection
+id: fbfef407-cfee-4866-88c1-f8de1c16147c
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
+  PUA protection.
+  Setting PUAProtection to 0 typically disables the detection and protection against Potentially Unwanted Applications 
+  by Microsoft Defender Antivirus. Potentially Unwanted Applications include software that may not be inherently 
+  malicious but could exhibit behaviors that users may find undesirable, such as adware, browser toolbars, or software bundlers.
+  Disabling this feature might be preferred in certain situations, but it's essential to consider potential security implications. 
+  Enabling PUA protection provides an additional layer of defense against software that might negatively impact user experience 
+  or security.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\PUAProtection"
+  Registry.registry_value_data="0x00000000"
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_pua_protection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender PUA protection set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml

@@ -0,0 +1,71 @@
+name: Windows Impair Defense Disable Realtime Signature Delivery
+id: ffd99aea-542f-448e-b737-091c1b417274
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable windows defender 
+  realtime signature delivery feature. This setting governs how Windows Defender Antivirus receives updated signature 
+  definitions for identifying and combating malware threats in real-time. The actual impact and behaviors associated 
+  with different values for RealtimeSignatureDelivery can vary based on specific Windows Defender configurations and policies.
+  For instance, setting this value to 0 or 1 might control whether real-time signatures are delivered via different methods 
+  such as through Windows Update or directly from Microsoft's cloud-based services.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery"
+  Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_realtime_signature_delivery_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender File realtime signature delivery set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_web_evaluation.yml

@@ -0,0 +1,75 @@
+name: Windows Impair Defense Disable Web Evaluation
+id: e234970c-dcf5-4f80-b6a9-3a562544ca5b
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
+  web content evaluation. The "EnableWebContentEvaluation" registry entry typically relates to security settings 
+  within Microsoft Edge or Internet Explorer, enabling the evaluation of web content for security purposes.
+  When attackers modify "EnableWebContentEvaluation" to 0, they might attempt to disable the browser's 
+  capability to evaluate web content for security purposes. Disabling this feature could potentially impact 
+  the browser's ability to assess the security risks associated with web content, such as potentially malicious scripts, 
+  active content, or unsafe web elements.
+  By turning off content evaluation, attackers might aim to exploit security vulnerabilities present in web content without 
+  triggering security warnings or blocks. This manipulation increases the risk of users accessing or interacting with malicious 
+  content, potentially leading to security compromises or system exploitation.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
+  WHERE Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation"  Registry.registry_value_data= "0x00000000" 
+  BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.registry_value_data Registry.process_guid 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_web_evaluation_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender web content evaluation feature set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml

@@ -0,0 +1,74 @@
+name: Windows Impair Defense Disable Win Defender App Guard
+id: 8b700d7e-54ad-4d7d-81cc-1456c4703306
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
+  audit application guard.
+  Microsoft Defender Application Guard provides enhanced security by isolating potentially malicious documents and 
+  websites in a containerized environment, protecting the system against various threats. Auditing and logging are 
+  essential components of security measures, providing visibility into activities within the isolated environment.
+  Disabling auditing events within Application Guard might not be a standard or recommended practice since auditing 
+  is crucial for security monitoring and threat detection within the isolated container. However, there might be 
+  settings or configurations related to audit policies in the broader Windows Defender or operating system settings.
+  This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard"
+  Registry.registry_value_data="0x00000000"
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_win_defender_app_guard_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender AuditApplicationGuard feature set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml

@@ -0,0 +1,70 @@
+name: Windows Impair Defense Disable Win Defender Compute File Hashes
+id: fe52c280-98bd-4596-b6f6-a13bbf8ac7c6
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender file hashes computation.
+  The EnableFileHashComputation registry setting likely pertains to whether Windows Defender's MpEngine (Malware Protection Engine) computes 
+  file hashes. Setting this value to 0 might disable the file hash computation feature within Windows Defender, which could affect certain 
+  malware detection or scanning functionalities that rely on file hash analysis. This registry setting is being abuse by several threat actors, adversaries 
+  and red teamers to bypasses Windows defender detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\MpEngine\\EnableFileHashComputation"
+  Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender File hashes computation set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml

@@ -0,0 +1,71 @@
+name: Windows Impair Defense Disable Win Defender Gen reports
+id: 93f114f6-cb1e-419b-ac3f-9e11a3045e70
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
+  generic ports. This registry can disable the sending of Watson events in Windows Defender. This is by preventing 
+  the transmission of generic or non-specific error reports to Microsoft's Windows Error Reporting service, 
+  commonly known as Watson. This kind of setting could potentially be employed to limit or control the data sent to 
+  Microsoft for error analysis, often in scenarios where privacy or specific reporting requirements are in place.
+  This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts"
+  Registry.registry_value_data="0x00000001"
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_win_defender_gen_reports_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender DisableGenericRePorts registry is set to enable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml

@@ -0,0 +1,71 @@
+name: Windows Impair Defense Disable Win Defender Network Protection
+id: 8b6c15c7-5556-463d-83c7-986326c21f12
+version: 1
+date: '2024-01-08'
+author: Teoderick Contreras, Splunk
+status: production
+type: TTP
+data_source:
+- Sysmon Event ID 12
+- Sysmon Event ID 13
+- Sysmon Event ID 14
+description: The following analytic identifies a modification in the Windows registry to disable Windows Defender 
+  exploit guard network protection. The EnableNetworkProtection registry entry controls the activation or deactivation 
+  of Network Protection within Windows Defender Exploit Guard. When set to 1, it typically signifies that Network Protection 
+  is enabled, offering additional security measures against network-based threats by analyzing and blocking potentially 
+  malicious network activity. This registry setting is being abuse by several threat actors, adversaries 
+  and red teamers to bypasses Windows defender detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection"
+  Registry.registry_value_data="0x00000000" 
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_impair_defense_disable_win_defender_network_protection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+references:
+- https://x.com/malmoeb/status/1742604217989415386?s=20
+- https://github.com/undergroundwires/privacy.sexy
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Windows Registry Abuse
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Windows Defender Exploit Guard network protection set to disable on $dest$.
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 49
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_value_name
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.action
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog