ASR rules categorized detection graph

Hunt Hypothesis

Adversaries may exploit misconfigured or outdated Azure Security Rules to bypass detection in specific categories like office-related activities or WMI. SOC teams should proactively hunt for this behavior to identify potential rule evasion tactics and ensure effective threat detection in their Azure Sentinel environment.

KQL Query

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "asr"
| extend Parsed = parse_json(AdditionalFields)
// | where Parsed.IsAudit == "true" 
| where Parsed.IsAudit == "false" 
| summarize Email = countif(ActionType in ("AsrExecutableEmailContentBlocked", "AsrOfficeCommAppChildProcessBlocked")),
            Script = countif(ActionType in ("AsrObfuscatedScriptBlocked", "AsrScriptExecutableDownloadBlocked")),
            WMI = countif(ActionType in ("AsrPersistenceThroughWmiBlocked", "AsrPsexecWmiChildProcessBlocked")),
            OfficeApp = countif(ActionType in ("AsrOfficeChildProcessBlocked", "AsrOfficeMacroWin32ApiCallsBlocked", "AsrExecutableOfficeContentBlocked", "AsrOfficeProcessInjectionBlocked")),
            3rdPartyApp = countif(ActionType == "AsrAdobeReaderChildProcessBlocked"),
            WindowsCredentials = countif(ActionType == "AsrLsassCredentialTheftBlocked"),
            PolymorphicThreats = countif(ActionType in ("AsrUntrustedExecutableBlocked", "AsrUntrustedUsbProcessBlocked", "AsrRansomwareBlocked", "AsrVulnerableSignedDriverBlocked")) by bin(Timestamp, 1d)
| render columnchart

Analytic Rule Definition

id: 4a7bf574-fe5f-4168-97e7-5a8aa19a5eed
name: ASR rules categorized detection graph
description: |
  This query offers daily categorization of ASR rules, helping SOC analysts monitor specific categories like office-related activities or WMI among the 16 rules. 
  It aids in tracking detection rates and organizational trends.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
tactics: []
query: |
   DeviceEvents
   | where Timestamp > ago(7d)
   | where ActionType startswith "asr"
   | extend Parsed = parse_json(AdditionalFields)
   // | where Parsed.IsAudit == "true" 
   | where Parsed.IsAudit == "false" 
   | summarize Email = countif(ActionType in ("AsrExecutableEmailContentBlocked", "AsrOfficeCommAppChildProcessBlocked")),
               Script = countif(ActionType in ("AsrObfuscatedScriptBlocked", "AsrScriptExecutableDownloadBlocked")),
               WMI = countif(ActionType in ("AsrPersistenceThroughWmiBlocked", "AsrPsexecWmiChildProcessBlocked")),
               OfficeApp = countif(ActionType in ("AsrOfficeChildProcessBlocked", "AsrOfficeMacroWin32ApiCallsBlocked", "AsrExecutableOfficeContentBlocked", "AsrOfficeProcessInjectionBlocked")),
               3rdPartyApp = countif(ActionType == "AsrAdobeReaderChildProcessBlocked"),
               WindowsCredentials = countif(ActionType == "AsrLsassCredentialTheftBlocked"),
               PolymorphicThreats = countif(ActionType in ("AsrUntrustedExecutableBlocked", "AsrUntrustedUsbProcessBlocked", "AsrRansomwareBlocked", "AsrVulnerableSignedDriverBlocked")) by bin(Timestamp, 1d)
   | render columnchart
   

Required Data Sources

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/ASR rules/ASR-rules-categorized-detection-graph.yaml)

False Positive Guidance

• Scenario: Scheduled System Maintenance Task
  Description: A legitimate scheduled task runs a system maintenance script that triggers ASR rule categorization.
  Filter/Exclusion: process.parent_process_name != "schtasks.exe" or process.name != "maintenance_script.exe"

• Scenario: Windows Update Installer Activity
  Description: The Windows Update installer (e.g., wusa.exe) may trigger ASR rules during system updates.
  Filter/Exclusion: process.name != "wusa.exe" or process.parent_process_name != "svchost.exe"

• Scenario: Admin Task for Log File Cleanup
  Description: An admin task configured to clean up log files may trigger ASR rules related to file system activity.
  Filter/Exclusion: process.name != "log_cleanup_tool.exe" or process.command_line contains "clean_logs"

• Scenario: Database Backup Job Execution
  Description: A database backup job (e.g., using SQL Server Backup Utility) may generate activity that matches ASR rule categories.
  Filter/Exclusion: process.name != "sqlbackup.exe" or process.command_line contains "backup"

• Scenario: User-Initiated File Search in Explorer
  Description: A user performing a file search via Windows Explorer may trigger ASR rules related to file system access.
  Filter/Exclusion: process.name != "explorer.exe" or process.command_line contains "search"