From 93417f0548a4100637e0351d56e51381c58ac75a Mon Sep 17 00:00:00 2001 From: eatinsundip <43767555+eatinsundip@users.noreply.github.com> Date: Fri, 1 Aug 2025 10:10:07 -0500 Subject: [PATCH 1/5] Create ClickFix Defense Evasion --- DefenderXDR/ClickFix Defense Evasion | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 DefenderXDR/ClickFix Defense Evasion diff --git a/DefenderXDR/ClickFix Defense Evasion b/DefenderXDR/ClickFix Defense Evasion new file mode 100644 index 0000000..21d35ed --- /dev/null +++ b/DefenderXDR/ClickFix Defense Evasion @@ -0,0 +1,6 @@ +//ClickFix Defense Evasion Checking for the use of 'SetClipboard -value " "' + +DeviceProcessEvents +| Where ProcessCommandLine has_all ("set-clipboard", "-value") +| where ProcessCommandLine has_any ('" "', "' '") +| project AccountName, ProccessCommandLine From c6f113e11b5f7355a19c11adb0cb9977c9b94679 Mon Sep 17 00:00:00 2001 From: eatinsundip <43767555+eatinsundip@users.noreply.github.com> Date: Wed, 13 Aug 2025 14:36:30 -0500 Subject: [PATCH 2/5] Create ClickFix Defense Evasion (DeviceEvents)) --- DefenderXDR/ClickFix Defense Evasion (DeviceEvents)) | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 DefenderXDR/ClickFix Defense Evasion (DeviceEvents)) diff --git a/DefenderXDR/ClickFix Defense Evasion (DeviceEvents)) b/DefenderXDR/ClickFix Defense Evasion (DeviceEvents)) new file mode 100644 index 0000000..c659c9a --- /dev/null +++ b/DefenderXDR/ClickFix Defense Evasion (DeviceEvents)) @@ -0,0 +1,8 @@ +// An alternate and slightly more succesful way of catching even obfuscated clipboard clearing. This technique is used for defense evasion with clickfix attacks. +// This detection can be ran in Defender NRT for quick response. + +DeviceEvents +| extend Command = tolower(parse_json(AdditionalFields)["Command"]) +| where Command has_all ("set-clipboard", "-value") +| where Command has_any ("' '", '" "') +| project Timestamp, InitiatingProcessAccountName, parse_json(AdditionalFields)["Command"], DeviceId, ReportId From 60d5c946f489e8332146a1110292e00e938a5321 Mon Sep 17 00:00:00 2001 From: eatinsundip <43767555+eatinsundip@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:24:38 -0600 Subject: [PATCH 3/5] Add KQL script for detecting 7-Zip suspicious processes This KQL script detects suspicious child processes spawned by 7-Zip executables in specific folders. --- .../7-Zip Spawning Suspicious Child Process.kql | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 DefenderXDR/7-Zip Spawning Suspicious Child Process.kql diff --git a/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql b/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql new file mode 100644 index 0000000..2a259d6 --- /dev/null +++ b/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql @@ -0,0 +1,14 @@ +// contact@ccaves.net for questions or contact +//7-Zip Spawning Suspicious Child Process + +DeviceFileEvents +| where InitiatingProcessFileName has_any (@"7z.exe", @"7zG.exe", @"7zFM.exe") +| where FileName endswith ".exe" + or FileName endswith ".dll" + or FileName endswith ".bat" + or FileName endswith ".cmd" + or FileName endswith ".ps1" + or FileName endswith ".vbs" + or FileName endswith ".iso" +| where FolderPath has_any (@"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\", @"\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\", @"\Windows\System32\", @"\Windows\SysWOW64\", @"\Windows\Tasks\", @"\Windows\Temp\") +| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, InitiatingProcessCommandLine, DeviceId, ReportId From 53fe98f493b49dc77eb55c23a3c1edbafe5fc206 Mon Sep 17 00:00:00 2001 From: eatinsundip <43767555+eatinsundip@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:31:07 -0600 Subject: [PATCH 4/5] Refactor KQL to use DeviceProcessEvents --- .../7-Zip Spawning Suspicious Child Process.kql | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql b/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql index 2a259d6..1cd80ed 100644 --- a/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql +++ b/DefenderXDR/7-Zip Spawning Suspicious Child Process.kql @@ -1,14 +1,8 @@ // contact@ccaves.net for questions or contact //7-Zip Spawning Suspicious Child Process -DeviceFileEvents -| where InitiatingProcessFileName has_any (@"7z.exe", @"7zG.exe", @"7zFM.exe") -| where FileName endswith ".exe" - or FileName endswith ".dll" - or FileName endswith ".bat" - or FileName endswith ".cmd" - or FileName endswith ".ps1" - or FileName endswith ".vbs" - or FileName endswith ".iso" -| where FolderPath has_any (@"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\", @"\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\", @"\Windows\System32\", @"\Windows\SysWOW64\", @"\Windows\Tasks\", @"\Windows\Temp\") -| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, InitiatingProcessCommandLine, DeviceId, ReportId +DeviceProcessEvents +| where InitiatingProcessCommandLine has_any (@"\7z.exe", @"\7zG.exe", @"\7zFM.exe") + or InitiatingProcessParentFileName has_any (@"\7z.exe", @"\7zG.exe", @"\7zFM.exe") +| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "bash.exe") +| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId, ReportId From 093879692eb8eeaa15c2058ccbb4cae52b7af2bb Mon Sep 17 00:00:00 2001 From: eatinsundip <43767555+eatinsundip@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:32:15 -0600 Subject: [PATCH 5/5] Add KQL query for 7-Zip arbitrary file write detection This KQL query identifies potential arbitrary file write attempts by 7-Zip to sensitive locations, filtering for specific file types and folders. --- ...Arbritrary File Write to Sensitive Location.kql | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 DefenderXDR/7-Zip Arbritrary File Write to Sensitive Location.kql diff --git a/DefenderXDR/7-Zip Arbritrary File Write to Sensitive Location.kql b/DefenderXDR/7-Zip Arbritrary File Write to Sensitive Location.kql new file mode 100644 index 0000000..63d3e82 --- /dev/null +++ b/DefenderXDR/7-Zip Arbritrary File Write to Sensitive Location.kql @@ -0,0 +1,14 @@ +// contact@ccaves.net for questions or contact +// 7-Zip Arbritrary File Write to Sensitive Location + +DeviceFileEvents +| where InitiatingProcessFileName has_any (@"7z.exe", @"7zG.exe", @"7zFM.exe") +| where FileName endswith ".exe" + or FileName endswith ".dll" + or FileName endswith ".bat" + or FileName endswith ".cmd" + or FileName endswith ".ps1" + or FileName endswith ".vbs" + or FileName endswith ".iso" +| where FolderPath has_any (@"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\", @"\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\", @"\Windows\System32\", @"\Windows\SysWOW64\", @"\Windows\Tasks\", @"\Windows\Temp\") +| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, InitiatingProcessCommandLine, DeviceId, ReportId