ASR Bypassing Writing Executable Content

Back


Id	efe4efef-5ca7-4b51-a53e-0e96492ce97a
Rulename	ASR Bypassing Writing Executable Content
Description	The query checks for any file which has been created/written by an Office application and shortly after renamed to one of the deny-listed “executable extensions” which are text files. (e.g. ps1, .js, .vbs).
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1211
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/ASRBypassingWritingExecutableContent.yaml
Version	1.0.0
Arm template	efe4efef-5ca7-4b51-a53e-0e96492ce97a.json

KQL

let timeframe = 1d;
let executableExtensions = dynamic([".js", ".hta", ".lnk", ".application", ".vb", ".vba", ".vbs", ".ps", ".ps1", ".bat", ".cmd"]);
DeviceFileEvents
| where Timestamp >= ago(timeframe)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
| where ActionType == "FileRenamed"
// The mv-apply is less performance compared to doing a full written out !endswith. We kept the mv-apply since We don't hit any limits and get more readable/maintainable code.
| mv-apply ext=executableExtensions to typeof(string) on
(
    where PreviousFileName !endswith ext and FileName endswith ext
)
| project-reorder PreviousFileName, FileName
// Begin allow-list.
// End allow-list.

YAML

version: 1.0.0
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
status: Available
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: DeviceName
  entityType: Host
- fieldMappings:
  - identifier: Sid
    columnName: InitiatingProcessAccountSid
  - identifier: Name
    columnName: InitiatingProcessAccountName
  - identifier: NTDomain
    columnName: InitiatingProcessAccountDomain
  entityType: Account
- fieldMappings:
  - identifier: CommandLine
    columnName: InitiatingProcessCommandLine
  entityType: Process
tactics:
- DefenseEvasion
relevantTechniques:
- T1211
queryFrequency: 1h
severity: Medium
name: ASR Bypassing Writing Executable Content
description: |
    The query checks for any file which has been created/written by an Office application and shortly after renamed to one of the deny-listed "executable extensions" which are text files. (e.g. ps1, .js, .vbs).
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/ASRBypassingWritingExecutableContent.yaml
query: |
  let timeframe = 1d;
  let executableExtensions = dynamic([".js", ".hta", ".lnk", ".application", ".vb", ".vba", ".vbs", ".ps", ".ps1", ".bat", ".cmd"]);
  DeviceFileEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
  | where ActionType == "FileRenamed"
  // The mv-apply is less performance compared to doing a full written out !endswith. We kept the mv-apply since We don't hit any limits and get more readable/maintainable code.
  | mv-apply ext=executableExtensions to typeof(string) on
  (
      where PreviousFileName !endswith ext and FileName endswith ext
  )
  | project-reorder PreviousFileName, FileName
  // Begin allow-list.
  // End allow-list.  
kind: Scheduled
queryPeriod: 1h
triggerOperator: gt
id: efe4efef-5ca7-4b51-a53e-0e96492ce97a

ARM