Re: Windows defender and calc abuse for dll sideloading

afurze — Wed, 03 Aug 2022 14:10:30 GMT

Hi Cyber1985,

If you have a Pro per Endpoint license then the Analytics Engine will identify this sort of thing for you, here are some relevant Analytics alerts that can fire:

Execution of a renamed LOLBIN
Recurring access to a rare IP
PowerShell runs suspicious base64 encoded command

Each of these alerts will generate incidents if they fire within your tenant. If you want to create your own XQL search you can go to Incident Response -> Query Builder -> XQL Search, here you can paste the query from the second article you linked and then you have the option to Run, Run in Background, Save or Schedule. If you want this to generate alerts if data is returned, you can save it as a correlation rule and it will then be run periodically and can create incidents (depending on the severity you set, medium and high severity generate alerts).

If you are a Prevent customer, then you do not have EDR data collection as a feature and will be unable to detect this sort of behavior.

topic Windows defender and calc abuse for dll sideloading in Cortex XDR Discussions

Windows defender and calc abuse for dll sideloading

Re: Windows defender and calc abuse for dll sideloading