ConfigureDefender utility for Windows 10

[Andy Ful]

silversurfer posted the example of advanced multistage malware:

Microsoft Spots Nodersok Malware Campaign That Zombifies PCs

A new fileless malicious campaign, dubbed Nodersok by Microsoft Defender ATP Research Team researchers who discovered it, drops its own LOLBins to infect Windows computers with a Node.js-based malware that will turn the devices into proxies. Unlike other fileless malware attacks that only use...

malwaretips.com

Here is a fragment from Microsoft article about WD protection which can fight such malware:
"

1. Machine learning models in the Windows Defender Antivirus client generically detects suspicious obfuscation in the initial HTA file used in this attack. Beyond this immediate protection, behavioral detection and containment capabilities can spot anomalous and malicious behaviors, such as the execution of scripts and tools. When the behavior monitoring engine in the client detects one of the more than 500 attack techniques, information like the process tree and behavior sequences are sent to the cloud, where behavior-based machine learning models classify files and identify potential threats.
2. Meanwhile, scripts that are decrypted and run directly in memory are exposed by Antimalware Scan Interface (AMSI) instrumentation in scripting engines, while launching PowerShell with a command-line that specifies encoded commands is defeated by command-line scanning. Tamper protection in Microsoft Defender ATP protects systems modifications that attempt to disable Windows Defender Antivirus.
3. These multiple layers of protection are part of the threat and malware prevention capabilities in Microsoft Defender ATP. The complete endpoint protection platform provides multiple capabilities that empower security teams to defend their organizations against attacks like Nodersok. Attack surface reduction shuts common attack surfaces. Threat and vulnerability management, endpoint detection and response, and automated investigation and remediation help organizations detect and respond to cyberattacks. Microsoft Threat Experts, Microsoft Defender ATP’s managed detection and response service, further helps security teams by providing expert-level monitoring and analysis."

"
I put here three paragraphs from this text into three points.
The first point is interesting because it is related to actions made by WD offline protection. It also clearly states how works the behavior monitoring engine:

"behavior monitoring engine in the client detects one of the more than 500 attack techniques, information like the process tree and behavior sequences are sent to the cloud, where behavior-based machine learning models classify files and identify potential threats."

The third point is mostly related to Windows E5 (except some ASR features).

 

[Andy Ful]

I wish I could see the ConfigureDefender Log from the last WD test:

https://malwaretips.com/threads/malware-samples-15-27-09-2019.95267/post-836914

I wonder if 4 script samples were missed, or some WD advanced settings silently blocked the malicious actions (or Windows 10 mitigations did this). In the end, the system seems protected. But, who knows?
The script 0.3614618.js was seen as a part of EMOTET attack.

 

[SeriousHoax]

I wish I could see the ConfigureDefender Log from the last WD test:

https://malwaretips.com/threads/malware-samples-15-27-09-2019.95267/post-836914

I wonder if 4 script samples were missed, or some WD advanced settings silently blocked the malicious actions. In the end, the system seems protected. But, who knows?
The script 0.3614618.js was seen as a part of EMOTET attack.

Ok, I'll save the log share here next time.

 

[Andy Ful]

Ok, I'll save the log share here next time.

Thanks, that would be great.

 

[oldschool]

I wonder if 4 script samples were missed, or some WD advanced settings silently blocked the malicious actions (or Windows 10 mitigations).

I wondered the same.

In the end, the system seems protected. But, who knows?

Or maybe protected but not clean?

 

[Andy Ful]

Some people would like to test if AMSI works on their computer. It is easy when using the test script prepared by Microsoft:
First copy/paste the below script to PowerShell console to see what command will be executed:

# AMSI test script
$base64 = "FHJ+YHoTZ1ZARxNgUl5DX1YJEwRWBAFQAFBWHgsFAlEeBwAACh4LBAcDHgNSUAIHCwdQAgALBRQ="
$bytes = [Convert]::FromBase64String($base64)
$string = -join ($bytes | % { [char] ($_ -bxor 0x33) })
# The variable $string contains the command that will be executed
$string

You will see the output:
'AMSI Test Sample: 7e72c3ce-861b-4339-8740-0ac1484c1386'
which is a decoded command.
After this execute this command:

iex $string

which should be blocked by WD:

Edit.
Converting from BASE64 is blocked in PowerShell Constrained Language mode, which is set by SRP default-deny, or can be set via SysHardener.

 

[Andy Ful]

WD offline detection c.d.

...
The first point is interesting because it is related to actions made by WD offline protection. It also clearly states how works the behavior monitoring engine:

"behavior monitoring engine in the client detects one of the more than 500 attack techniques, information like the process tree and behavior sequences are sent to the cloud, where behavior-based machine learning models classify files and identify potential threats."
...

Fragment from MS article:

How artificial intelligence stopped an Emotet outbreak | Microsoft Security Blog

At 12:46 a.m. local time on February 3, a Windows 7 Pro customer in North Carolina became the first would-be victim of a new malware attack campaign for Trojan:Win32/Emotet. In the next 30 minutes, the campaign tried to attack over a thousand potential victims, all of whom were instantly and...

www.microsoft.com

"When the client-based machine learning model predicts a high probability of maliciousness, a rich set of feature vectors is then prepared to describe the content. These feature vectors include:

• Behavior during emulation, such as API calls and executed code
• Similarity fuzzy hashes
• Vectors of content descriptive flags optimized for use in ML models
• Researcher-driven attributes, such as packer technology used for obfuscation
• File name
• File size
• Entropy level
• File attributes, such as number of sections
• Partial file hashes of the static and emulated content

This set of features form a signal sent to the Windows Defender AV cloud protection service, which runs a wide array of more complex models in real-time to instantly classify the signal as malicious or benign."

 

[Andy Ful]

SUMMARY of WD offline non-signature detection/blocking on Windows Home and Pro.

1. WD offline non-signature detection uses Machine Learning models, behavior-based algorithms, generics (based on similarities to known malware), and heuristics.
2. AMSI is used to log/detect unobfuscated script actions.
3. Most of these features apply to images in memory and are optimized to detect suspicious behavior and trigger the cloud backend.
4. WD can be configured to use also ASR rules and Controlled Folder Access to block locally, malicious behaviors.

It seems that WD main offline protection is based on malware signatures, and can be extended by using ASR rules and Controlled Folder Access. Other features are mostly the interlude to the cloud backend.
Of course, in the home environment, offline protection is supported by cloud protection even when the user is offline! The main malware delivery is due to the Internet, so if the user is well protected online (web protection, BAFS, etc.), then there is usually no malware on disk when being offline. This may work well for many users, but there are some exceptions, for example when downloading/unpacking files without MOTW (like from USB drives, via 7-ZIP unpacker, etc.).

 

[Special]

Got a (hopfully) simple question, why are there ?????? here?



What is this suppose to be?

 

[oldschool]

Got a (hopfully) simple question, why are there ?????? here?



What is this suppose to be?

Probably needed filler for that field in the GUI program. Otherwise it wouldn't have been complete. @Andy Ful can verify.

 

[SeriousHoax]

@Andy Ful
Log from the latest test if you're interested: https://malwaretips.com/threads/malware-samples-19-30-09-2019.95316/
Log

 

[bribon77]

I still use H_C, with Emsisoft and Run By Smartscreen and zero problem I have given way to some portable programs that blocked H_C and nothing perfect.
Thanks Andy for your great program.

 

[Andy Ful]

Got a (hopfully) simple question, why are there ?????? here?



What is this suppose to be?

Nothing related to ConfigureDefender, for sure.

 

[Andy Ful]

@Andy Ful
Log from the latest test if you're interested: https://malwaretips.com/threads/malware-samples-19-30-09-2019.95316/
Log

Thanks for the Log. WD behavior blocking features did very well when blocking the malicious actions of SoundSysK.exe and remittance.jar . Even the autorun registry changes were blocked.
The second malware is nasty:

Analysis remittance.jar (MD5: 79E1B51C470D6B34943FA9654C06D2B7) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

 

[blueblackwow65]

Hi just wondering why is cpu load at scanning at 50% with high settings? Is this on demand scanning only? Not realtime?

 

[Andy Ful]

Hi just wondering why is cpu load at scanning at 50% with high settings? Is this on demand scanning only? Not realtime?

On demand.

 

[oldschool]

Hi just wondering why is cpu load at scanning at 50% with high settings? Is this on demand scanning only? Not realtime?

You can change it > lower number if desired. My guess it's for all scans and real-time, but that doesn't mean it always uses 50%. I imagine under stress when encountering malware e.g. testing, is when it will spike. Those who have tested it could give a more accurate answer than mine.

 

[Andy Ful]

Two samples from the last test on Malware Hub were analysed on app.any.run:
XLSTATSTART.exe: XLSTATSTART.exe (MD5: D123307F59547AABBA880487738540AF) - Interactive analysis - ANY.RUN
CK_19617_9585862810069.vbs: CK_19617_9585862810069.vbs (MD5: 8D658117310B8089242C9E9C572DDE73) - Interactive analysis - ANY.RUN

The second was probably mitigated by ASR rules, because it drops a payload and runs it via WMI.

 

[harlan4096]

@Andy Ful: what about XLSTATSTART.exe? I got final verdict from KVirusDesk is clean, also appears as Trusted in KSN...

I've also tested with KTS2020d (defaults) and :

​

I've tested and triggers cmd.exe -> conhost.exe for about 1 second and auto terminates, it only left a 0 KB file... false positive??

 

[SeriousHoax]

CK_19617_9585862810069.vbs: CK_19617_9585862810069.vbs (MD5: 8D658117310B8089242C9E9C572DDE73) - Interactive analysis - ANY.RUN

The second was probably mitigated by ASR rules, because it drops a payload and runs it via WMI.

I checked log, there wasn't anything in the log about this sample.