Windows Defender Decoder ?

[Rob B]

Hello All,

   Does anyone have a decoder for Windows Defender floating around out there??

Im having a heck of a time...   Here is the event channel event example if anyone is curious or can help:  (Win10 box)

Log Name:      Microsoft-Windows-Windows Defender/Operational

Source:        Microsoft-Windows-Windows Defender

Date:          4/22/2016 4:05:17 PM

Event ID:      1116

Task Category: None

Level:         Warning

Keywords:      

User:          SYSTEM

Computer:      VICTIM0

Description:

Windows Defender has detected malware or other potentially unwanted software.

 For more information please see the following:

http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Bagsu!rfn&threatid=2147694406&enterprise=0

  Name: Trojan:Win32/Bagsu!rfn

  ID: 2147694406

  Severity: Severe

  Category: Trojan

  Path: containerfile:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe;file:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe;file:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe->(VFS:svchost.exe)

  Detection Origin: Network share

  Detection Type: Concrete

  Detection Source: Real-Time Protection

  User: frog

  Process Name: C:\Windows\explorer.exe

  Signature Version: AV: 1.217.2054.0, AS: 1.217.2054.0, NIS: 115.8.0.0

  Engine Version: AM: 1.1.12603.0, NIS: 2.1.11804.0

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}" />

    <EventID>1116</EventID>

    <Version>0</Version>

    <Level>3</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8000000000000000</Keywords>

    <TimeCreated SystemTime="2016-04-22T20:05:17.551083000Z" />

    <EventRecordID>95</EventRecordID>

    <Correlation ActivityID="{ECC2B320-F9A6-41AD-9F17-5C9EE24D3330}" />

    <Execution ProcessID="2332" ThreadID="4540" />

    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>

    <Computer>VICTIM0</Computer>

    <Security UserID="S-1-5-77" />

  </System>

  <EventData>

    <Data Name="Product Name">%%827</Data>

    <Data Name="Product Version">4.9.10586.0</Data>

    <Data Name="Detection ID">{CAADD684-36C9-444B-8A6D-8CE537A93E40}</Data>

    <Data Name="Detection Time">2016-04-22T20:04:40.369Z</Data>

    <Data Name="Unused">

    </Data>

    <Data Name="Unused2">

    </Data>

    <Data Name="Threat ID">2147694406</Data>

    <Data Name="Threat Name">Trojan:Win32/Bagsu!rfn</Data>

    <Data Name="Severity ID">5</Data>

    <Data Name="Severity Name">Severe</Data>

    <Data Name="Category ID">8</Data>

    <Data Name="Category Name">Trojan</Data>

    <Data Name="FWLink">http://go.microsoft.com/fwlink/?linkid=37020&amp;name=Trojan:Win32/Bagsu!rfn&amp;threatid=2147694406&amp;enterprise=0</Data>

    <Data Name="Status Code">1</Data>

    <Data Name="Status Description">

    </Data>

    <Data Name="State">1</Data>

    <Data Name="Source ID">3</Data>

    <Data Name="Source Name">%%818</Data>

    <Data Name="Process Name">C:\Windows\explorer.exe</Data>

    <Data Name="Detection User">frog</Data>

    <Data Name="Unused3">

    </Data>

    <Data Name="Path">containerfile:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe;file:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe;file:_\\10.0.1.10\share\Malware_For_Demo\REAL_BAD_Malz2\Server.exe-&gt;(VFS:svchost.exe)</Data>

    <Data Name="Origin ID">2</Data>

    <Data Name="Origin Name">%%846</Data>

    <Data Name="Execution ID">1</Data>

    <Data Name="Execution Name">%%813</Data>

    <Data Name="Type ID">0</Data>

    <Data Name="Type Name">%%822</Data>

    <Data Name="Pre Execution Status">0</Data>

    <Data Name="Action ID">9</Data>

    <Data Name="Action Name">%%887</Data>

    <Data Name="Unused4">

    </Data>

    <Data Name="Error Code">0x00000000</Data>

    <Data Name="Error Description">The operation completed successfully. </Data>

    <Data Name="Unused5">

    </Data>

    <Data Name="Post Clean Status">0</Data>

    <Data Name="Additional Actions ID">0</Data>

    <Data Name="Additional Actions String">No additional actions required</Data>

    <Data Name="Remediation User">

    </Data>

    <Data Name="Unused6">

    </Data>

    <Data Name="Signature Version">AV: 1.217.2054.0, AS: 1.217.2054.0, NIS: 115.8.0.0</Data>

    <Data Name="Engine Version">AM: 1.1.12603.0, NIS: 2.1.11804.0</Data>

  </EventData>

</Event>

Thanks!, Rob

[dan (ddp)]

On Fri, Apr 22, 2016 at 4:16 PM, Rob B <rba...@netorian.com> wrote:
> Hello All,
>
> Does anyone have a decoder for Windows Defender floating around out
> there??
>
> Im having a heck of a time... Here is the event channel event example if
> anyone is curious or can help: (Win10 box)
>

The easiest way to provide log samples that can be turned into
decoders and rules is to turn on the logall option, and grab the logs
from /var/ossec/logs/archives/archives.log on the manager.

> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Rob B]

dang good idea!   thanks dan!

[joe.co...@wazuh.com]

Rob,

Just a tip

 If you have virtual box or VMware, throw a Manager on their and use it to test your rules and decoders. You can just paste the log into ossec-logtest. It will sure save you a lot of heartache when troubleshooting.

Hope that helps

[Brent Morris]

Rob - can you post your OSSEC version of the log?  I can check my rules.  These are a culmination of gleaned rules that I updated some time back with new event IDs.  Yours is covered in there....  but I would like to test it against a valid OSSEC log.  So if you can post it from the OSSEC logs, that'd be great.

Here they are..

</group>

<!-- Microsoft Security Essentials rules -->

<!-- see https://technet.microsoft.com/en-us/library/hh144989.aspx -->

<group name="windows,mse,">

  <rule id="720001" level="0">

    <category>windows</category>

    <if_sid>18101,18102,18103</if_sid>

    <extra_data>^Microsoft Antimalware</extra_data>

    <description>Grouping of Microsoft Security Essentials rules.</description>

  </rule>

  <rule id="720010" level="12">

    <if_sid>720001</if_sid>

    <id>^1118$|^1119$</id>

    <group>virus,</group>

    <description>Microsoft Security Essentials - Virus detected, but unable to remove.</description>

  </rule>

  <rule id="720011" level="7">

    <if_sid>720001</if_sid>

    <id>^1117$</id>

    <group>virus,</group>

    <description>Microsoft Security Essentials - Virus detected and properly removed.</description>

  </rule>

  <rule id="720012" level="7">

    <if_sid>720001</if_sid>

    <id>^1119$|^1118$|^1117$|^1116$</id>

    <group>virus,</group>

    <description>Microsoft Security Essentials - Virus detected.</description>

  </rule>

  <rule id="720013" level="7">

    <if_sid>720001</if_sid>

    <id>^1015$</id>

    <group>virus,</group>

    <description>Microsoft Security Essentials - Suspicious activity detected.</description>

  </rule>

   <!-- Service conditions and errors -->

  <rule id="720020" level="3">

    <if_sid>720001</if_sid>

    <id>^5007$</id>

    <description>Microsoft Security Essentials - Configuration changed.</description>

    <group>policy_changed,</group>

  </rule>

  <rule id="720021" level="9">

    <if_sid>720001</if_sid>

    <id>^5008$</id>

    <description>Microsoft Security Essentials - Service failed.</description>

  </rule>

  <rule id="720022" level="9">

    <if_sid>720001</if_sid>

    <id>^3002$</id>

    <description>Microsoft Security Essentials - Real time protection failed.</description>

  </rule>

  <rule id="720023" level="8">

    <if_sid>720001</if_sid>

    <id>^2012$</id>

    <description>Microsoft Security Essentials - Cannot use Dynamic Signature Service.</description>

  </rule>

  <rule id="720024" level="8">

    <if_sid>720001</if_sid>

    <id>^2004$</id>

    <description>Microsoft Security Essentials - Loading definitions failed. Using last good set.</description>

  </rule>

  <rule id="720025" level="8">

    <if_sid>720001</if_sid>

    <id>^2003$</id>

    <description>Microsoft Security Essentials - Engine update failed.</description>

  </rule>

  <rule id="720026" level="8">

    <if_sid>720001</if_sid>

    <id>^2001$</id>

    <description>Microsoft Security Essentials - Definitions update failed.</description>

  </rule>

  <rule id="720027" level="7">

    <if_sid>720001</if_sid>

    <id>^1005$</id>

    <description>Microsoft Security Essentials - Scan error. Scan has stopped.</description>

  </rule>

  <rule id="720028" level="5">

    <if_sid>720001</if_sid>

    <id>^1002$</id>

    <description>Microsoft Security Essentials - Scan stopped before completion.</description>

  </rule>

  <!-- EICAR test file special case -->

  <!-- www.eicar.org/86-0-Intended-use.html -->

  <rule id="720041" level="5">

    <if_sid>720012</if_sid>

    <match>Virus:DOS/EICAR_Test_File</match>

    <options>alert_by_email</options>

    <description>Microsoft Security Essentials - EICAR test file detected.</description>

  </rule>

  <rule id="720042" level="3">

    <if_sid>720011</if_sid>

    <match>Virus:DOS/EICAR_Test_File</match>

    <options>alert_by_email</options>

    <description>Microsoft Security Essentials - EICAR test file removed.</description>

  </rule>

  <rule id="720043" level="8">

    <if_sid>720010</if_sid>

    <match>Virus:DOS/EICAR_Test_File</match>

    <options>alert_by_email</options>

    <description>Microsoft Security Essentials - EICAR test file detected, but removal failed.</description>

  </rule>

  <!-- Status messages -->

  <rule id="720050" level="3">

    <if_sid>720001</if_sid>

    <id>^2000$</id>

    <description>Microsoft Security Essentials - Signature database updated.</description>

  </rule>

  <rule id="720051" level="3">

    <if_sid>720001</if_sid>

    <id>^2002$</id>

    <description>Microsoft Security Essentials - Scan engine updated.</description>

  </rule>

  <rule id="720053" level="3">

    <if_sid>720001</if_sid>

    <id>^1000$|^1001$</id>

    <description>Microsoft Security Essentials - Scan started or stopped.</description>

  </rule>

  <rule id="720054" level="4">

    <if_sid>720001</if_sid>

    <id>^1013$</id>

    <description>Microsoft Security Essentials - History cleared.</description>

  </rule>

  <!-- Time based alerts -->

  <rule id="720070" level="10" frequency="4" timeframe="240">

    <if_matched_sid>720011</if_matched_sid>

    <description>Multiple Microsoft Security Essentials AV warnings detected.</description>

  </rule>

  <rule id="720071" level="10" frequency="4" timeframe="240">

    <if_matched_sid>720012</if_matched_sid>

    <description>Multiple Microsoft Security Essentials AV warnings detected.</description>

  </rule>

</group> <!-- mse -->

[Rob B]

Thanks Brent.!     Funny enough, that day I figured it out and built a whole bunch very similar to your list.  Seems to be working very nicely, as now I find myself leaning to creating some down right creative composites....  (finally)

I've been looking for some reference material on the <extra_data> tag?  How is this used properly?

Cheers!   Rob

[Pedro S]

Hi Rob,

extra_data is another allowed field used by OSSEC decoders to extract information from the event, once it is extracted you can match the field content in order to create a rule.

The content of extra_data depends on the decoder which extracted it, in Windows decoders could be for example: Win source, Parent Image, Protocol, Signature, Start function...

Best regards,

Pedro S.

[Rob B]

Nice!  Thanks Pedro!  I've got it now..

Cheers.

[Jesus Linares]

Hi Brent,

Your rules are in OSSEC by default (with other ID, why?) but you added a few new rules. 

could you send a PR to OSSEC or Wazuh with your new rules?. 

Thanks.

[Brent Morris]

Hi Jesus,

Yeah, I think I submitted a pull request into OSSEC some time back on this...  If memory serves, the other IDs are because I used the existing MS ID schema for OSSEC.  The odd IDs are just because these live in my local_rules.xml in production.  Sadly, I haven't had the time to update OSSEC or try any of the new distributions lately.

[Ed Davison]

It would be great to see the decoder entries that go with these rules ...  I know this is an older post but maybe you are still around and can share the decoder and maybe the plugin as well?

[dan (ddp)]

On Wed, Mar 1, 2017 at 6:40 PM, Ed Davison <edav...@gmail.com> wrote:
> It would be great to see the decoder entries that go with these rules ... I
> know this is an older post but maybe you are still around and can share the
> decoder and maybe the plugin as well?
>

If you can provide log samples, we can work on decoders. :-)

> On Monday, May 16, 2016 at 4:22:08 PM UTC-5, Brent Morris wrote:
>>
>> Rob - can you post your OSSEC version of the log? I can check my rules.
>> These are a culmination of gleaned rules that I updated some time back with
>> new event IDs. Yours is covered in there.... but I would like to test it
>> against a valid OSSEC log. So if you can post it from the OSSEC logs,
>> that'd be great.
>>
>> Here they are..
>>

[Ed Davison]

On Wednesday, March 1, 2017 at 7:31:58 PM UTC-6, dan (ddpbsd) wrote:

On Wed, Mar 1, 2017 at 6:40 PM, Ed Davison <edav...@gmail.com> wrote:
> It would be great to see the decoder entries that go with these rules ...  I
> know this is an older post but maybe you are still around and can share the
> decoder and maybe the plugin as well?
>


If you can provide log samples, we can work on decoders. :-)

Sure thing.  Here are two examples.  I can probably extrapolate the other events if I can get these working.  It would be great if USERDATA fields could be filled with items like: User, Name, Category, Process Name, Severity, Path.

2017 Mar 03 10:06:20 (TEST2) 10.10.15.x->WinEvtLog 2017 Mar 03 10:06:16 WinEvtLog: Microsoft-Windows-Windows Defender/Operational: INFORMATION(1117): Microsoft-Windows-Windows Defender: SYSTEM: NT AUTHORITY: TEST2.domain.net: Windows Defender has taken action to protect this machine from malware or other potentially unwanted software.   For more information please see the following:  http://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0      Name: Virus:DOS/EICAR_Test_File         ID: 2147519003          Severity: Severe        Category: Virus         Path: containerfile:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part;file:_C:\Users\user\AppData\Local\Temp\U6ZR55qF.com.part;file:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part->(Zip);file:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part->eicar.com        Detection Origin: Local machine         Detection Type: Concrete       Detection Source: Real-Time Protection           User: NT AUTHORITY\SYSTEM      Process Name: C:\Program Files (x86)\Mozilla Firefox\firefox.exe         Action: Quarantine      Action Status:  No additional actions required          Error Code: 0x00000000          Error description: The operation completed successfully.        Signature Version: AV: 1.237.484.0, AS: 1.237.484.0, NIS: 116.72.0.0   Engine Version: AM: 1.1.13504.0, NIS: 2.1.12706.0

2017 Mar 03 10:05:54 (TEST2) 10.10.15.x->WinEvtLog 2017 Mar 03 10:05:50 WinEvtLog: Microsoft-Windows-Windows Defender/Operational: WARNING(1116): Microsoft-Windows-Windows Defender: SYSTEM: NT AUTHORITY: TEST2.domain.net: Windows Defender has detected malware or other potentially unwanted software.   For more information please see the following:  http://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0           Name: Virus:DOS/EICAR_Test_File         ID: 2147519003          Severity: Severe       Category: Virus          Path: containerfile:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part;file:_C:\Users\user\AppData\Local\Temp\U6ZR55qF.com.part;file:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part->(Zip);file:_C:\Users\user\AppData\Local\Temp\ZUNXLCOu.zip.part->eicar.com        Detection Origin: Local machine         Detection Type: Concrete        Detection Source: Real-Time Protection          User: DOMAIN\user     Process Name: C:\Program Files (x86)\Mozilla Firefox\firefox.exe        Signature Version: AV: 1.237.484.0, AS: 1.237.484.0, NIS: 116.72.0.0    Engine Version: AM: 1.1.13504.0, NIS: 2.1.12706.0