Defender Advanced Hunting: A Comprehensive Guide

Imagine this scenario: You’re deep into an investigation, tracking down suspicious behavior across your organization’s network. You’ve set up alerts, and the moment a breach is detected, you turn to your Defender Advanced Hunting queries. The powerful tool enables you to sift through massive amounts of data in real-time to pinpoint the root cause of an incident, respond swiftly, and prevent further damage. But how do you actually construct these advanced hunting queries?

Welcome to this deep dive into Defender Advanced Hunting (DAH), the querying language of Microsoft Defender for Endpoint, designed to help security professionals proactively identify and respond to threats. Throughout this article, we’ll not only explore examples of DAH queries but also provide a step-by-step breakdown of how you can tailor them to your unique environment.

The Power of Kusto Query Language (KQL):

At the core of DAH lies the Kusto Query Language (KQL). It’s an expressive, powerful, yet user-friendly query language that lets you retrieve data from Defender’s backend systems quickly. Whether you’re a seasoned professional or just getting started with security, understanding and leveraging KQL is essential to maximizing your security capabilities.

1. Query for Malicious Process Execution
   Sometimes, a simple query can be all that stands between identifying a breach early and letting it slip under the radar. For example:

kql
DeviceProcessEvents
| where FileName == "malware.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath
| order by Timestamp desc

This query looks for instances where a process named “malware.exe” was executed. It filters results to show relevant fields like the timestamp, device name, initiating process, and folder path. This can help you quickly identify when and where the file was executed.

1. Detecting Suspicious PowerShell Use
   PowerShell is frequently used in attacks due to its versatility. The following query helps to identify potentially malicious PowerShell scripts:

kql
DeviceProcessEvents
| where InitiatingProcessFileName == "powershell.exe"
| where ProcessCommandLine contains "Invoke-WebRequest" or ProcessCommandLine contains "DownloadFile"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, AccountName
| order by Timestamp desc

This example detects PowerShell commands that contain terms like Invoke-WebRequest or DownloadFile, which are often used in file download operations from malicious sites. Analyzing command line arguments can be a rich source of insights into how attackers manipulate tools to carry out malicious activities.

Building Complex Queries:
Once you’ve mastered simple queries, the next step is to combine them into more complex scenarios. For example, you might want to hunt for behavior that indicates lateral movement or privilege escalation.

1. Query for Lateral Movement via SMB
   Lateral movement is a critical indicator of attackers moving through your network. An attacker might use SMB (Server Message Block) protocol to spread malware or move laterally:

kql
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" and RemotePort == 445
| project Timestamp, DeviceName, RemoteIP, InitiatingProcessFileName, AccountName
| order by Timestamp desc

This query searches for successful SMB connections, which typically operate over port 445. You can project fields like the timestamp, device name, remote IP, and initiating process to quickly identify suspicious lateral movement attempts.

Efficiency with Time Constraints:
In the fast-paced environment of incident response, speed is crucial. DAH allows for time-bounded searches, so you only see results from a specific timeframe.

1. Query with Time Constraints
   Here’s an example of how to run a time-limited query:

kql
DeviceProcessEvents
| where Timestamp between (datetime(2024-09-01T00:00:00Z)..datetime(2024-09-23T23:59:59Z))
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, AccountName
| order by Timestamp desc

In this case, the query limits results to events occurring between September 1st and September 23rd, 2024. This approach helps narrow down investigations and increases performance by avoiding unnecessary data retrieval.

Customization and Filtering:
Tailoring DAH queries to your organization's environment is key to getting meaningful results. This might involve customizing the filtering criteria to match known patterns of legitimate or suspicious behavior.

1. Excluding Specific Devices or Processes
   Let’s say you want to exclude certain devices or processes from your results because you’ve already ruled them out as benign:

kql
DeviceProcessEvents
| where FileName != "known_safe_process.exe" and DeviceName != "trusted_device"
| project Timestamp, DeviceName, FileName, AccountName
| order by Timestamp desc

By excluding known safe processes and devices, you can focus your efforts on what remains potentially malicious.

The Art of Continuous Monitoring:
While DAH is immensely powerful, its true value lies in continuous monitoring. Proactive hunting and alerting can often stop attacks before they fully materialize.

Setting Up Alerts from Queries:
Once you’ve created and validated your queries, the next logical step is to set up alerts. For instance, if you frequently see PowerShell exploitation in your environment, you can configure an alert directly in the Microsoft 365 Defender portal using your custom query.

Working with Tabular Data for Better Insights:
In many cases, working with tabular data helps security analysts make sense of large datasets quickly. Microsoft Defender provides tables like DeviceProcessEvents, DeviceNetworkEvents, and AlertEvents to help categorize data.

Table Name	Use Case
DeviceProcessEvents	Monitoring process creation and termination
DeviceNetworkEvents	Observing network connections
AlertEvents	Viewing triggered alerts

Key Takeaways and Conclusion:

Defender Advanced Hunting, powered by Kusto Query Language (KQL), offers security professionals unparalleled power to hunt down and neutralize threats. From simple process hunting to complex queries that uncover lateral movement or suspicious command-line arguments, DAH empowers you to act swiftly and confidently.

If there’s one takeaway from this article, it’s this: mastering DAH can transform your security operations. By building effective, customizable queries, you can stay ahead of attackers and protect your organization with confidence.

Are you ready to level up your threat hunting game?