ASR Rare and Untrusted Executables

Group by: FileName, SHA1
Author: Cyb3rMonk
Source: github.com/Cyb3r-Monk/Threat-Hunting-and-Detection

Below query shows Untrusted executables that are seen on few devices (LocalPrevalence). It requires the below ASR rule to be configured and Cloud-delivered protection to be enabled.
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
You may need to exclude software development users/machines/folders.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

References

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion

Telemetry coverage

Provider	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `AsrUntrustedExecutableAudited`: ASR untrusted executable (audited)
Microsoft Defender for Endpoint	`DeviceEvents` action `AsrUntrustedExecutableBlocked`: ASR untrusted executable (blocked)
Microsoft Defender for Endpoint	`DeviceFileCertificateInfo` action `any`: File signing certificate information
Windows-Defender	Event ID 1121: Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
Windows-Defender	Event ID 1122: Microsoft Defender Exploit Guard audited an operation that is not allowed by your IT administrator.

Rule body

// Author: Cyb3rMonk(https://twitter.com/Cyb3rMonk, https://mergene.medium.com)
//
// Query parameters:
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType in ("AsrUntrustedExecutableAudited","AsrUntrustedExecutableBlocked")
| summarize arg_min(Timestamp,*), LocalPrevalence = dcount(DeviceId) by SHA1, FileName
| where Timestamp > ago(1d)
| where LocalPrevalence <= 5
// there might be files without signature info, perform leftouter join
| join kind=leftouter (
    DeviceFileCertificateInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp,*) by SHA1
    )
    on SHA1
// Get GlobalPrevalence info, etc.
| invoke FileProfile(SHA1, 1000)
// GlobalFirstSeen can be used for filtering the results further
// If you want to list only the files that have invalid signatures uncomment the below line
// there might be files without signature info, don't exclude them
// | where IsTrusted <> 1

Stages and Predicates

Stage 1: `source`

DeviceEvents

Stage 2: `where`

| where Timestamp > ago(30d)

Stage 3: `where`

| where ActionType in ("AsrUntrustedExecutableAudited","AsrUntrustedExecutableBlocked")

Stage 4: `summarize`

| summarize arg_min(Timestamp,*), LocalPrevalence = dcount(DeviceId) by SHA1, FileName

Stage 5: `where`

| where Timestamp > ago(1d)

Stage 6: `where`

| where LocalPrevalence <= 5

Stage 7: `join`

| join kind=leftouter (
    DeviceFileCertificateInfo
    | where Timestamp > ago(30d)
    | summarize arg_max(Timestamp,*) by SHA1
    )
    on SHA1

Stage 8: `invoke`

| invoke FileProfile(SHA1, 1000)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	in	`AsrUntrustedExecutableAudited` `AsrUntrustedExecutableBlocked`	`field:"ActionType" kind:in`
`LocalPrevalence`	le	`5`	`field:"LocalPrevalence" kind:le value:"5"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FileName`	`summarize`
`LocalPrevalence`	`summarize`
`SHA1`	`summarize`

ASR Rare and Untrusted Executables

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: where

Stage 6: where

Stage 7: join

Stage 8: invoke