Jan 16 2023 03:32 AM
Jan 16 2023 03:32 AM
Following the Friday 13th event with Defender ASR block and removing of shortcut links. Has anyone been able to use the Defender Timeline information on assets to report on the shortcut links which were removed?
In my case we do not have any data reporting the deletion of the file itself. We do have the ASR event on machines but it also clear that we have lots of other application shortcuts disappearing without ASR events being triggered. This means we cannot get a true idea of the scale of the issue for my estate.
Note - We don't have VSS enabled on the endpoints.
Is there any other method of getting some idea of what has been deleted?
Jan 16 2023 03:58 AM
Jan 16 2023 04:05 AM
Jan 16 2023 06:23 AM
Jan 16 2023 09:03 AM
I had the same issue as you. The KQL query provided by Microsoft did not return all the deleted .lnk files. In the timeline of our devices I found entries with the ActionType "BrowserLaunchedToOpenUrl" and the additional information "T1204.002: Malicious File". Based on that I built the following query:
DeviceEvents | where Timestamp >= datetime(2023-01-13) and Timestamp < datetime(2023-01-14) | where ActionType contains "BrowserLaunchedToOpenUrl" | where RemoteUrl endswith ".lnk" | summarize by Timestamp, DeviceName, DeviceId, RemoteUrl,ActionType | sort by Timestamp asc
The RemoteURL shows the deleted .lnk file.
From there you can further filter for the start menu folder:
DeviceEvents | where Timestamp >= datetime(2023-01-13) and Timestamp < datetime(2023-01-14) | where ActionType contains "BrowserLaunchedToOpenUrl" | where RemoteUrl endswith ".lnk" | where RemoteUrl contains "start menu" | summarize by Timestamp, DeviceName, DeviceId, RemoteUrl,ActionType | sort by Timestamp asc
Let me know if this helps!
Jan 17 2023 12:48 AM
Thank-you for the great reply. Putting your query to work now but having to use Sentinel as we are getting more than 10000 records. Did try to see if I could add the AV signature as a column but failed to get that to work correctly.
Jan 17 2023 04:01 AM
Jan 17 2023 04:19 AM
Hi @Yong Rhee, not tried the script as it wouldn't help us.
We have an estate of 6000 devices onboarded to Defender and Intune managed. No way to centrally report the data back but I can't trust that the ASR events has been recorded as we have proof that devices have had shortcuts removed and the Defender advanced hunting has not reported an ASR event for the file.
Jan 17 2023 04:27 AM
Jan 17 2023 05:04 AM
@Yong Rhee Already using that query but you can't tell if the machine was affected by the problem signatures so you have to assume the worst case. Would be helpful if you can tie the machine signature details to the timestamp for filtering.
Jan 17 2023 05:06 AM
Jan 17 2023 06:08 AM
Jan 17 2023 06:35 AM
@Yong Rhee Tried the AH query but the returned data records is too small.
When you exclude '| where AvSignatureVersion in (badsignatures)' from the query and in my case see most of the machines have an AV signature version of 1.381.2325.0.
Jan 17 2023 06:45 AM
Jan 17 2023 06:52 AM
Jan 17 2023 06:57 AM