Windows defender and calc abuse for dll sideloading

[Cyber1985]

Hello dear community, 

Has anyone build a xql query for this case:

https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-str...

Should this help?

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-hunting-renamed-lolbins-process-exec...

And how do we Set this two queries up?

BR 

Rob

[afurze]

Hi Cyber1985,

If you have a Pro per Endpoint license then the Analytics Engine will identify this sort of thing for you, here are some relevant Analytics alerts that can fire:

• Execution of a renamed LOLBIN 
• Recurring access to a rare IP 
• PowerShell runs suspicious base64 encoded command 

Each of these alerts will generate incidents if they fire within your tenant.  If you want to create your own XQL search you can go to Incident Response -> Query Builder -> XQL Search, here you can paste the query from the second article you linked and then you have the option to Run, Run in Background, Save or Schedule.  If you want this to generate alerts if data is returned, you can save it as a correlation rule and it will then be run periodically and can create incidents (depending on the severity you set, medium and high severity generate alerts).

If you are a Prevent customer, then you do not have EDR data collection as a feature and will be unable to detect this sort of behavior.