The article explains how Microsoft Defender Attack Surface Reduction (ASR) rules can block suspicious Windows behaviors such as WMI-based process creation, persistence, copied system tools, and malicious Office activity, while also logging configuration changes. It also shows how Wazuh collects ASR telemetry and uses custom rules to detect and visualize blocked actions and ASR tampering on Windows endpoints. #MicrosoftDefender #Wazuh #ASR #WMI
Keypoints
- Microsoft Defender ASR rules can block or audit behaviors commonly abused by attackers on Windows endpoints.
- Wazuh ingests ASR events from the Microsoft-Windows-Windows Defender/Operational channel for centralized detection and correlation.
- The blog uses Block mode ASR rules to monitor five abuse patterns: PSExec/WMI process creation, WMI persistence, copied system tools, Office child processes, and Office-created executable content.
- ASR events are identified by event IDs 1121 for blocks and 5007 for configuration changes.
- Custom Wazuh rules are created to map specific ASR GUIDs to detections and MITRE ATT&CK techniques.
- Testing shows Wazuh can alert on blocked activity and on ASR rule mode tampering attempts.
- Tamper Protection may prevent ASR configuration changes made through Add-MpPreference.
MITRE Techniques
- [T1047] Windows Management Instrumentation – Used to create a process remotely through WMI; [“blocked process creation via PSExec or WMI”]
- [T1021.002] SMB/Windows Admin Shares – Included in the PSExec/WMI-related rule coverage for remote execution paths; [“blocked process creation via PSExec or WMI”]
- [T1570] Lateral Tool Transfer – Associated with PSExec/WMI process creation abuse for moving execution across systems; [“blocked process creation via PSExec or WMI”]
- [T1569.002] Service Execution – Associated with PSExec-style remote execution blocked by ASR; [“blocked process creation via PSExec or WMI”]
- [T1546.003] Windows Management Instrumentation Event Subscription – Used to create a permanent WMI event subscription for persistence; [“blocked the creation of a permanent WMI event subscription”]
- [T1036.003] Masquerading – Used by copying notepad.exe and renaming it to svchost_fake.exe to imitate a legitimate system tool; [“blocked execution of a copied or impersonated system tool”]
- [T1204.002] User Execution: Malicious File – Office was used to launch a child process through a macro; [“blocked an Office application from creating a child process”]
- [T1059] Command and Scripting Interpreter – A macro launched cmd.exe to execute commands; [“Shell “cmd.exe /c echo test””]
- [T1562.001] Impair Defenses – ASR configuration mode was changed to Disabled and then re-enabled; [“Microsoft Defender ASR rule configuration changed”]
Indicators of Compromise
- [GUIDs] ASR rule identifiers used in detection and testing – d1e49aac-8f56-4280-b9ba-993a6d77406c, e6db77e5-3df2-4cf1-b95a-636979351e5b, and 3b576869-a4ec-4529-8536-b80a7769e899
- [Event IDs] Microsoft Defender ASR and configuration events – 1121, 5007, and 1122
- [File names] Test and dropped binaries used during simulation – svchost_fake.exe, report_generator.exe
- [Windows registry path] Office macro security setting location – HKCU:SoftwareMicrosoftOfficeWordSecurity
- [File paths] Temporary files created during testing – $env:TEMPunsigned.exe, $env:TEMPunsigned.cs, and $env:TEMPsvchost_fake.exe
- [Process names] Executables launched or referenced in tests – cmd.exe, notepad.exe, and csc.exe
Read more: https://wazuh.com/blog/detecting-windows-attacks-with-microsoft-defender-asr-and-wazuh/