detect-bluekeep-related-mining

Description

This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep). CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets. Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat. The following query locates devices where the known coin miner payload was dropped. References: https://nvd.nist.gov/vuln/detail/CVE-2019-0708 https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/ https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/ https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708 https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708 https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/

Query · kql

// Suggest setting Timestamp starting from September 6th
// when the BlueKeep Metasploit module was released
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath endswith "spool\\svchost.exe"
or SHA1=="82288c2dc5c63c1c57170da91f9979648333658e"
Raw source detect-bluekeep-related-mining · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2bf77176-1b8a-4466-9b64-6b9fd4023fa5
name: detect-bluekeep-related-mining
description: |
  This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
  CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
  Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
  The following query locates devices where the known coin miner payload was dropped.
  References:
  https://nvd.nist.gov/vuln/detail/CVE-2019-0708
  https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
  https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
  https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
  https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
  https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Execution
query: |
  // Suggest setting Timestamp starting from September 6th
  // when the BlueKeep Metasploit module was released
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where FolderPath endswith "spool\\svchost.exe"
  or SHA1=="82288c2dc5c63c1c57170da91f9979648333658e"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.