MosaicLoader

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `RegistryValueSet`: Registry value set
Microsoft Defender for Endpoint	`DeviceRegistryEvents` action `any`: Registry activity

Rule body

id: 506f4d6b-3864-4bb1-8f75-a13fb066f97a
name: MosaicLoader
description: |
  This query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceRegistryEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
tags:
  - MosaicLoader
  - Windows Defender Exclusions
query: |
  DeviceRegistryEvents 
  | where ((ActionType == "RegistryValueSet") and (RegistryKey startswith @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" 
  or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions"
  or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes"))
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: RegistryValue
    fieldMappings:
      - identifier: Name
        columnName: RegistryValueName
      - identifier: Value
        columnName: RegistryValueData
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceRegistryEvents

Stage 2: `where`

| where ((ActionType == "RegistryValueSet") and (RegistryKey startswith @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" 
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions"
or RegistryKey startswith @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes"))

Stage 3: `extend`

| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)

HostName =

ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))

elseDeviceName

Stage 4: `extend`

| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

DnsDomain =

ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`RegistryValueSet` corpus 2 (kusto 2)	`field:"EventType" kind:eq value:"RegistryValueSet"`
`RegistryKey`	starts_with	`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions` `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes` `HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths`	`field:"TargetObject" kind:starts_with`

Output fields

These fields are emitted when the rule matches.

Field	Source
`HostName`	`extend`
`DnsDomain`	`extend`