hunting

4 Topics

Running a registry based query
Hello, we have some computers which we need to find out the specific registry value in order to be able to update their OS. The path: HKEY_LOCAL_MACHINE\software\policies\Microsoft\Windows\WindowsUpdate\AU The value (Dword): NoAutoUpdate I want to find out which computers that are onboarded to defender for endpoint has this registry set to "1"/On. Thanks for help
MREVCI
Oct 25, 2021 Place Microsoft Defender for Endpoint
7.9KViews
0likes
4Comments
Which schema belong to which service?
Hello there, So I'm pretty familiar with KQL and MDATPs default schemas found under Advanced Hunting. There are of course some more schemas/tables found under MTP compared to MDATP (https://security.microsoft.com/advanced-hunting Is there any general cheat-sheet on which schema originates from which service? For example if I would hunt under the "MiscEvents" schema, what do I need to do to add it? What I mean is, I would like to try this query: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726 But I can't seem to find "MiscEvents" in either Log Analytics, Defender ATP or M365 Threat Protection. Do I miss something? Is Azure ATP needed for the "MiscEvents" table to be populated? Regards Simon
Solved
0fflinedocs
Aug 06, 2020 Place Microsoft Defender for Endpoint
2.1KViews
0likes
2Comments
DeviceFileCertificateInfo table
Hi All I want to play around with file reputation under MDATP Advanced hunting. The only place where I can find file information like this seems to be only under the DeviceFileCertificateInfo table (where I can find IsSigned and IsTrusted property). So far it's not that bad, but the issue I have is that this table uses data obtained from certificate verification activities regularly performed on files on endpoints. and doesn't seems to receive all the validation done at each time. Ex.: I execute a exe file from powershell but didn't see the executed file's hash in the DeviceFileCertificateInfo table. Is that normal ? Is there another place where I should find those information ? Thanks in advanced
Dezzzzzzzz
Jul 07, 2020 Place Microsoft Defender for Endpoint
1.1KViews
0likes
0Comments
Threats > August 2019 RDP update advisory > Hunting Query
Hi! In the "August 2019 RDP update advisory" threat page, there is a hunting query: // Find unusual processes with outbound connections to TCP port 3389 NetworkCommunicationEvents | where RemotePort == 3389 | where ActionType == "ConnectionSuccess" and Protocol == "Tcp" | where InitiatingProcessFileName !in~ //Remove common RDP programs ("mstsc.exe","RTSApp.exe", "RTS2App.exe","RDCMan.exe","ws_TunnelService.exe", "RSSensor.exe","RemoteDesktopManagerFree.exe","RemoteDesktopManager.exe", "RemoteDesktopManager64.exe","mRemoteNG.exe","mRemote.exe","Terminals.exe", "spiceworks-finder.exe","FSDiscovery.exe","FSAssessment.exe", "chrome.exe", "microsodeedgecp.exe", "LTSVC.exe", "Hyper-RemoteDesktop.exe", "", "RetinaEngine.exe", "Microsoft.Tri.Sensor.exe" ) and InitiatingProcessFolderPath !has "program files" and InitiatingProcessFolderPath !has "winsxs" and InitiatingProcessFolderPath !contains "windows\\sys" | where RemoteIP !in("127.0.0.1", "::1") | summarize ComputerNames = make_set(ComputerName), ListofMachines = make_set(MachineId), make_set(EventTime), ConnectionCount = dcount(RemoteIP) by InitiatingProcessFileName, InitiatingProcessSHA1, bin(EventTime, 1d) I am unable to create a detection rule based off this query alone: "Unable to save detection rule The query does not return the following columns that are required to create a detection rule: MachineId ReportId " Can someone hit me up with a modified query that you can create a detection rule on?
Solved
Maximilian Grandahl Lærum
Sep 19, 2019 Place Microsoft Defender for Endpoint
2.2KViews
0likes
2Comments