MosaicLoader

Back


Id	506f4d6b-3864-4bb1-8f75-a13fb066f97a
Rulename	MosaicLoader
Description	This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.
Severity	High
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Defender XDR/Analytic Rules/Exploits/MosaicLoader.yaml
Version	1.0.0
Arm template	506f4d6b-3864-4bb1-8f75-a13fb066f97a.json

KQL

DeviceRegistryEvents 
| where ((ActionType == "RegistryValueSet") and (RegistryKey startswith @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" 
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions"
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes"))
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Defender XDR/Analytic Rules/Exploits/MosaicLoader.yaml
query: |
  DeviceRegistryEvents 
  | where ((ActionType == "RegistryValueSet") and (RegistryKey startswith @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" 
  or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions"
  or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes"))
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")  
requiredDataConnectors:
- dataTypes:
  - DeviceRegistryEvents
  connectorId: MicrosoftThreatProtection
tactics:
- DefenseEvasion
name: MosaicLoader
kind: Scheduled
relevantTechniques:
- T1562
severity: High
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceName
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
- fieldMappings:
  - identifier: Name
    columnName: RegistryValueName
  - identifier: Value
    columnName: RegistryValueData
  entityType: RegistryValue
tags:
- MosaicLoader
- Windows Defender Exclusions
queryFrequency: 1h
description: |
    This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.
triggerThreshold: 0
triggerOperator: gt
version: 1.0.0
queryPeriod: 1h
id: 506f4d6b-3864-4bb1-8f75-a13fb066f97a

ARM