Shield Break Behaviour

Query

let lookback = 14d;
let excluded_processes = dynamic([
    "MsMpEng.exe",
    "MpCmdRun.exe",
    "NisSrv.exe",
    "SenseIR.exe"
]);
let cloudapi_loads =
    DeviceImageLoadEvents
    | where Timestamp >= ago(lookback)
    | where FileName =~ "CldApi.dll"
        or FolderPath has @"\CldApi.dll"
        or FileName =~ "taskschd.dll"
        or FolderPath has @"\taskschd.dll"
    | where InitiatingProcessFileName !in~ (excluded_processes)
    | project
        DeviceId,
        DeviceName,
        InitiatingProcessId,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        InitiatingProcessIntegrityLevel,
        ModuleLoadTime = Timestamp,
        ModulePath = FolderPath,
        ModuleName = FileName
    | summarize
        FirstModuleLoad=min(ModuleLoadTime),
        LastModuleLoad=max(ModuleLoadTime),
        ModulePaths=make_set(ModulePath, 20),
        ModuleNames=make_set(ModuleName, 20)
      by DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessIntegrityLevel;
let suspicious_file_activity =
    DeviceFileEvents
    | where Timestamp >= ago(lookback)
    | where ActionType in~ ("FileCreated", "FileModified", "FileRenamed", "FileDeleted")
    | where
          FileName in~ ("BERLIN", "phoneinfo.dll", "Report.wer", "SHIELDBREAK")
       or FolderPath has @"\BaseNamedObjects\Restricted\WD_"
       or FolderPath has @"\ShieldBreak_"
       or FolderPath has @"\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_"
       or FolderPath has @".\globalroot\BaseNamedObjects\Restricted\WD_"
    | where InitiatingProcessFileName !in~ (excluded_processes)
    | project
        DeviceId,
        DeviceName,
        InitiatingProcessId,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        FileName,
        FolderPath,
        ActionType,
        FileEventTime = Timestamp
    | summarize
        FirstFileEvent=min(FileEventTime),
        LastFileEvent=max(FileEventTime),
        FileNames=make_set(FileName, 20),
        FolderPaths=make_set(FolderPath, 50),
        ActionTypes=make_set(ActionType, 20)
      by DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine;
let combined =
    cloudapi_loads
    | join kind=inner suspicious_file_activity on DeviceId, InitiatingProcessId
    | extend SuspiciousScore = 40 + 30 + 10
    | where SuspiciousScore >= 60
    | project
        Timestamp = LastFileEvent,
        DeviceId,
        DeviceName,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        InitiatingProcessIntegrityLevel,
        ModuleNames,
        ModulePaths,
        FileNames,
        FolderPaths,
        ActionTypes,
        SuspiciousScore;
combined
| order by Timestamp desc

About this query

Explanation

This KQL query is designed to detect potential security threats by monitoring specific system activities that could indicate an attempt to bypass security defenses. Here's a simplified breakdown of what the query does:

Lookback Period: The query examines events from the past 14 days.
Excluded Processes: Certain processes known to be safe (like "MsMpEng.exe" and others) are excluded from the analysis to reduce false positives.
Module Loading Monitoring:
- It tracks processes that load specific system modules, such as "CldApi.dll" and "taskschd.dll".
- It collects details about these module load events, including the process that initiated the load and the time of the event.
Suspicious File Activity:
- It looks for unusual file operations (creation, modification, renaming, deletion) involving specific files or directories that are often associated with malicious activity.
- It gathers information about these file events, including the process involved and the type of file operation.
Correlation of Events:
- The query combines the data from module loading and suspicious file activity to identify processes that are involved in both activities.
- It assigns a "Suspicious Score" to these combined events, with a threshold set to highlight potentially malicious behavior.
Output:
- The results are sorted by the most recent events and include details such as the process name, command line, integrity level, loaded modules, file names, and paths involved in the suspicious activity.

Overall, this query aims to identify processes that might be attempting to evade detection by security tools, focusing on specific behaviors that are known to be associated with such tactics.