Suspicious Windows Defender Exclusion Added For Uncommon Files

Query

let RegLookback          = 7d;
let FileLookback         = 30d;
let MinGlobalPrevalence  = 2500;
let MinGlobalAge         = 10d;
let TargetRegistryKeys = dynamic([
    @"SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions",
    @"SOFTWARE\Microsoft\Windows Defender\Exclusions"
]);
let LegitimateProcesses = dynamic(["MsMpEng.exe", "NisSrv.exe"]);
let ThereforePdfRegex = @"(?i)^(%USERPROFILE%\\AppData\\Local|C:\\Program Files(\s\(x86\))?)\\Therefore\\.*\.pdf$";
let Exclusions = materialize(
    DeviceRegistryEvents
    | where Timestamp > ago(RegLookback)
    | where RegistryKey has_any (TargetRegistryKeys)
    | where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
    | where isnotempty(RegistryValueName)
    | where not(RegistryValueName matches regex ThereforePdfRegex)
    | where not(InitiatingProcessFileName in~ (LegitimateProcesses))
    | extend ExclusionScope   = tostring(split(RegistryKey, @"\")[-1])
    | extend ExcludedFileName = tolower(tostring(split(RegistryValueName, @"\")[-1]))
    | summarize arg_max(Timestamp, *) by RegistryValueName, DeviceId
);
let ExclusionNames = toscalar(
    Exclusions
    | where ExcludedFileName has "." and ExcludedFileName !has "*"
    | summarize make_set(ExcludedFileName, 1000)
);
let HashCandidates = materialize(
    union isfuzzy=true
        (DeviceProcessEvents   | where Timestamp > ago(FileLookback) | project DeviceId, FileName, FolderPath, SHA1, SHA256),
        (DeviceImageLoadEvents | where Timestamp > ago(FileLookback) | project DeviceId, FileName, FolderPath, SHA1, SHA256),
        (DeviceFileEvents      | where Timestamp > ago(FileLookback) | project DeviceId, FileName, FolderPath, SHA1, SHA256)
    | extend ExcludedFileName = tolower(FileName)
    | where ExcludedFileName in (ExclusionNames)
    | where isnotempty(SHA1)
    | summarize LocalDeviceCount = dcount(DeviceId), FolderPathSample = take_any(FolderPath)
        by ExcludedFileName, SHA1, SHA256
);
let Profiles =
    HashCandidates
    | distinct SHA1
    | take 1000
    | invoke FileProfile("SHA1", 1000)
    // Enforce schema explicitly, otherwise it gets lost during the join
    | project SHA1,
        ProfPrevalence   = tolong(GlobalPrevalence),
        ProfFirstSeen    = GlobalFirstSeen,
        ProfSigner       = Signer,
        ProfAvailability = ProfileAvailability;
let HashSets =
    HashCandidates
    | join kind=leftouter (Profiles) on SHA1
    | extend Prevalence     = coalesce(ProfPrevalence, long(0)) 
    | extend FirstObservedG = coalesce(ProfFirstSeen, now())
    // Exclusion criteria: globally widespread OR known for a long time
    | where not(Prevalence >= MinGlobalPrevalence and FirstObservedG <= ago(MinGlobalAge))   
| summarize
        FileHashes        = make_set(SHA1, 50),
        FileHashesSHA256  = make_set(SHA256, 50),
        FolderPaths       = make_set(FolderPathSample, 20),
        Signers           = make_set_if(ProfSigner, isnotempty(ProfSigner), 10),
        ProfileStates     = make_set(ProfAvailability, 5),
        HashCount         = dcount(SHA1),
        MinPrevalence     = min(Prevalence),
        MaxPrevalence     = max(Prevalence),
        FirstObserved     = min(FirstObservedG),
        LocalDeviceCount  = sum(LocalDeviceCount)
        by ExcludedFileName;
Exclusions
| join kind=inner (HashSets) on ExcludedFileName
| project
    Timestamp,
    DeviceName,
    ExclusionScope,
    RegistryValueName,
    ExcludedFileName,
    HashCount,
    FileHashes,
    FileHashesSHA256,
    FolderPaths,
    Signers,
    ProfileStates,
    MinPrevalence,
    MaxPrevalence,
    FirstObserved,
    LocalDeviceCount,
    InitiatingProcessFileName,
    InitiatingProcessAccountName,
    InitiatingProcessCommandLine,
    DeviceId
| order by HashCount desc, Timestamp desc

About this query

Explanation

This query is designed to detect suspicious changes to Windows Defender settings, specifically when uncommon files are added as exclusions. Here's a simple breakdown of what the query does:

Purpose: The query aims to identify potentially malicious activity where an attacker might add exclusions to Windows Defender to prevent it from scanning certain files. This is a common tactic to evade detection by security tools.
Key Components:
- Registry Monitoring: It looks at recent changes (within the last 7 days) to specific Windows Defender registry keys that manage exclusions.
- Exclusion Filtering: It filters out known benign processes and certain file patterns to focus on potentially suspicious changes.
- File Analysis: It checks the files that have been excluded against a list of recently observed files (within the last 30 days) to see if they are globally uncommon (i.e., not widely seen across many systems).
- Global Prevalence Check: Files that are not globally prevalent (less than 2500 instances) and not known for a long time (less than 10 days) are flagged as suspicious.
Output: The query produces a list of suspicious exclusions, showing details such as the file names, their hash values, the paths where they were found, any known signers, and the processes that initiated the exclusion.
Risk: This activity is categorized under "Defense Evasion" in cybersecurity, as it involves modifying security settings to avoid detection.
MITRE ATT&CK Techniques: The query is associated with techniques T1685 (Disable or Modify Tools) and T1564.012 (File/Path Exclusions), which are tactics used by attackers to disable or bypass security tools.

Overall, this query is a proactive measure to detect and investigate potential security threats by monitoring changes to Windows Defender's exclusion settings.