Detections against ShieldBreak exploitation attempt

[onurmerdogan]

Details

New exploit targeting Windows Defender remediation process was published under ShieldBreak alias, below content was added to cover its detection.

Stories

• Rogue Planet: Updated existing story with the new exploit information

Data sources

• Windows Event Log Defender 1116: Added "Malware Detection" events from Windows Defender
• Windows Event Log Defender 1117: Added "Remediation action taken" events from Windows Defender

Detections

• Windows Alternate Data Stream Created Over Local Share: The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address.
• Windows Defender MpClient.dll Loaded by non-Defender Process: The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform.
• Windows Defender Threat Detected on Kernel Object Path: The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace.
• Windows Error Report Created in ReportQueue Manually: The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
• Windows Phoneinfo.dll Created on Disk: The following analytic detects the creation of a file named phoneinfo.dll anywhere on disk.
• Windows Wermgr Spawning System Integrity Process: The following analytic detects wermgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.