Detect process drops via Azure Custom Script Extension performing lateral movement

Group by: InitiatingProcessSHA256, SHA256
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule spots processes that where dropped via Azure Custom Script Extension on a machine and are now performing lateral movement. A common procedures for attackers when they compromised one machine is to move laterally to other machines via common protocols such as RDP, SSH, VNC, WMI, RPC, etc. It is not very common in an environment that Custom Script Extensions is being used for this.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1651` Cloud Administration Command
Lateral Movement	`T1021.008` Remote Services: Direct Cloud VM Connections

References

https://thecollective.eu/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceFileEvents` action `FileCreated`: File created
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionAttempt`: Connection attempted
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionFailed`: Connection failed
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionRequest`: Connection request
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `ConnectionSuccess`: Connection succeeded

Rule body

let process_drop_via_arc = (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    // Search for file created events by Arc Custom Script Handler
    | where ActionType == "FileCreated"
    | where InitiatingProcessFileName =~ "customscripthandler.exe"
    | where isnotempty(SHA256)
    | distinct SHA256
);
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| join kind=inner process_drop_via_arc on $left.InitiatingProcessSHA256 == $right.SHA256
| where RemotePort in ("5985", "5986", "445", "3389", "22", "5900", "135")
| where ActionType in~ ("ConnectionSuccess", "ConnectionAttempt", 
"ConnectionFailed", "ConnectionRequest")

Stages and Predicates

Let binding: `process_drop_via_arc` used in Stages 1, 4

let process_drop_via_arc = (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "FileCreated"
    | where InitiatingProcessFileName =~ "customscripthandler.exe"
    | where isnotempty(SHA256)
    | distinct SHA256
);

Stage 1: `source`

let process_drop_via_arc

Stage 2: `source`

DeviceNetworkEvents

Stage 3: `where`

where TimeGenerated > ago(3600s)

Stage 4: `join`

join kind=inner (process_drop_via_arc) on InitiatingProcessSHA256, SHA256

Stage 5: `where`

where RemotePort in~ (135, 22, 3389, 445, 5900, 5985, 5986)

Stage 6: `where`

where ActionType in~ ("ConnectionAttempt", "ConnectionFailed", "ConnectionRequest", "ConnectionSuccess")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`FileCreated`	`field:"ActionType" kind:eq value:"FileCreated"`
`ActionType`	in	`ConnectionAttempt` `ConnectionFailed` `ConnectionRequest` `ConnectionSuccess`	`field:"ActionType" kind:in`
`InitiatingProcessFileName`	eq	`customscripthandler.exe`	`field:"parent_process_name" kind:eq value:"customscripthandler.exe"`
`RemotePort`	in	`135` `22` `3389` `445` `5900` `5985` `5986`	`field:"DestinationPort" kind:in`
`SHA256`	is_not_null	(no value, null check)	`field:"sha256" kind:is_not_null`

Detect process drops via Azure Custom Script Extension performing lateral movement

MITRE ATT&CK coverage

References

Telemetry coverage

Rule body

Stages and Predicates

Let binding: process_drop_via_arc used in Stages 1, 4

Stage 1: source

Stage 2: source

Stage 3: where

Stage 4: join

Stage 5: where

Stage 6: where