FalconForce unknown stable kql

ASR Bypass Executable Content

There is an ASR rule that detects whenever an Office application writes an executable file to disk. There is a documented bypass for this rule, which allows an attacker to write the file to disk with a benign extension (e.g., .txt or .tmp) and rename the file afterwards. This query tries to detect such behavior.

View Source

Detection Logic

let timeframe = 2*1h;
let default_global_prevalence = 0;
let executableExtensions = dynamic([".js", ".hta", ".vb", ".vba", ".vbs", ".ps", ".ps1", ".bat", ".cmd", ".lnk", ".application"]);
DeviceFileEvents
| where ingestion_time() >= ago(timeframe)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
| where ActionType =~ "FileRenamed"
| where FileName has_any(executableExtensions)
| extend MatchExt = executableExtensions[has_any_index(FileName ,executableExtensions)]
| where iff (isempty(PreviousFileName) ,true, PreviousFileName !endswith MatchExt)
// There is some Office feature which triggers a behavior where a .tmp file with "~ew shortcut.tmp" is created
// and then renamed to New Shortcut.lnk. However, since the filename is localized to the local Windows version, we can't use
// the English names for New Shortcut and we have to do the string magic below to replace the first char with an ~ and the .lnk with .tmp.
| where not(strcat("~", replace_string(substring(FileName, 1), ".lnk", ".tmp")) =~ PreviousFileName)
| mv-apply ext=executableExtensions to typeof(string) on
(
    where  FileName endswith ext
)
| project-reorder PreviousFileName, FileName
// FileProfile is case-sensitive and works on lower-case hashes.
| extend SHA1=tolower(SHA1)
| invoke FileProfile(SHA1, 1000)
| where not(ProfileAvailability =~ "Error")
| where coalesce(GlobalPrevalence,default_global_prevalence) < 500
// Begin environment-specific filter.
// End environment-specific filter.

Field Validations

Loading…

Comments (0)

Loading comments...