Detect executable drops via Azure custom script extension

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule flags when the Custom Script extension service on a machine is dropping executable files. This might indicate that an actor is trying to drop malware or beacons via a compromised cloud admin account. In the most legitimate cases administrators are pushing only PowerShell or Shell scripts, although these can also contain malicious content. Be aware of this gap in the below detection rule.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1651` Cloud Administration Command
Lateral Movement	`T1021.008` Remote Services: Direct Cloud VM Connections

References

https://thecollective.eu/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceFileEvents` action `FileCreated`: File created
Microsoft Defender for Endpoint	`DeviceFileEvents` action `any`: File activity

Rule body

// Executable extensions we want to flag (you can also add .ps1 and .sh)
let win_executable_extensions = dynamic([".dll", ".exe", ".msi", ".bat", ".cmd", ".com", ".vbs", ".wsf", ".scr", ".cpl"]);
DeviceFileEvents
| where TimeGenerated > ago(1h)
// Search for file created events by Arc Custom Script Handler
| where ActionType == "FileCreated"
| where InitiatingProcessFileName =~ "customscripthandler.exe"
// Get the file type
| extend FileType = tostring(parse_json(AdditionalFields).FileType)
// Flag on extension or executable file type
| where FileName has_any (win_executable_extensions) or 
    FileType contains "Executable"

Stages and Predicates

Parameters

let win_executable_extensions = dynamic([".dll", ".exe", ".msi", ".bat", ".cmd", ".com", ".vbs", ".wsf", ".scr", ".cpl"]);

Stage 1: `source`

DeviceFileEvents

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where ActionType == "FileCreated"

Stage 4: `where`

| where InitiatingProcessFileName =~ "customscripthandler.exe"

Stage 5: `extend`

| extend FileType = tostring(parse_json(AdditionalFields).FileType)

Stage 6: `where`

| where FileName has_any (win_executable_extensions) or 
    FileType contains "Executable"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`FileCreated`	`field:"ActionType" kind:eq value:"FileCreated"`
`FileName`	match	`.bat` transforms: `term` `.cmd` transforms: `term` `.com` transforms: `term` `.cpl` transforms: `term` `.dll` transforms: `term` `.exe` transforms: `term` `.msi` transforms: `term` `.scr` transforms: `term` `.vbs` transforms: `term` `.wsf` transforms: `term`	`field:"file_name" kind:match`
`FileType`	contains	`Executable`	`field:"FileType" kind:contains value:"Executable"`
`InitiatingProcessFileName`	eq	`customscripthandler.exe`	`field:"parent_process_name" kind:eq value:"customscripthandler.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FileType`	`extend`