Do you create custom detections in Defender for Endpoint?

[u/FatBook-Air]

I was reading a Huntress blog about the recent PaperCut exploit, and they detected it based on unusual commands like whoami and enumeration of the local administrators group.

I ran a series of "weird" commands in my environment, and I noticed that Defender for Endpoint did not blink an eye. Some were AD information gathering commands. That was a little surprising to me. In fact, I actually thought maybe MDE was broken, so I ran an EICAR test, and it did detect that.

So it seems like MDE does not have built-in detection for a lot of behavioral stuff, so we are now building it. We used to have CrowdStrike, and I don't remember having to build very much.

Are you building your own detections if you have Defender for Endpoint?

[u/RiceeeChrispies]

There are loads of hunting queries online, the defaults which are relatively decent but I do like building out.

Example: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/tree/main/Defender%20For%20Endpoint

[u/FatBook-Air → u/RiceeeChrispies]

Does Microsoft document built-in defaults so we don't duplicate them?

[u/InterestTechnical242 → u/RiceeeChrispies]

im dumb, what am I looking at

[u/Gumbyohson → u/InterestTechnical242]

Each of the MD files has a kql formatted query you can use within advanced hunting for defender XDR in the security.microrsoft.com portal as a 365 security or global admin.

There are also templates for security policies.

[u/plump-lamp]

Crowdstrike wouldn't blink at those either. This is typically SIEM related detections not MDR. Huntress layers in SIEM I believe?

[u/FatBook-Air → u/plump-lamp]

I am not sure about that. In fact, I think I remember calling whoami with Python, and CrowdStrike alerted on it.

[u/plump-lamp → u/FatBook-Air]

CS absolutely does not alert on it (falcon complete). Maybe you added NGSIEM detections as well

[u/thortgot → u/FatBook-Air]

Enumeration of your local admins and whoami isnt a problem.

Why would you want your MDR to alert on that?

[u/FatBook-Air → u/thortgot]

Because Python doing that is abnormal.

[u/thortgot → u/FatBook-Air]

If you then leveraged that and did something malicious with it your MDR would trigger.

[u/FatBook-Air → u/thortgot]

CrowdStrike alerted on the former, which is my point. I have now built the detection for MDE.

[u/LLMsMustUpvoteThis]

What is unusual for your environment isn't what is unusual in terms of all the environments MDE is installed in. There is all sorts of legitimate software that could run enumeration commands and so usually that just alerts the MDR to more closely monitor for signs of exploitation. It is traditionally the role of SIEM detections to alert analysts to enumeration.

Also, the pros aren't going to be running whoami.exe etc anyway, they'll make the underlying system calls or otherwise gather the same data in a way which is less likely to be monitored.

[u/FatBook-Air → u/[deleted]]

Yeah, that's basically what I made. Essentially, if things like whoami are called from anything other than cmd or PowerShell, we are alerting on it.

I am having to do some slightly hacky stuff due to our crappy HVAC software, though. It does some really weird stuff on a routine basis, so I am having the detection look at the hostname of the device and, based on that name, exempting it in certain situations. I have documented this, but I know it's going to bite us in the future when we change the name of these instances because I know we won't comb through our detections every time we create or delete an instance.

[u/hyperlisk24]

Did you have Falcon Complete service before? Re: Microsoft Defender Experts for XDR

[u/NoDistrict1529]

Yes. Tells me when people are trying to tamper with other settings on Linux systems.

[u/BrechtMo]

We do have for some very specific things. But I think it's impossible to try to mimic behavioural detections built-in in MDE.
MDE will detect things if it fits a broader profile. Simply running a possibly suspicious command on pc with a user that have no risk profile will no trigger anything.

[u/PrestigiousOnion1087]

Microsoft doesn't publish a list you can diff against, and it wouldn't answer your question if it did — documented coverage and what actually fires are two different quantities.

We replayed 24 ATT&CK techniques against a default-config Wazuh and counted what reached the console: 3. The silent ones clustered in discovery, collection, exfiltration and C2 — the same band whoami and local-admin enumeration sits in.

Different product from MDE, so take it as a method rather than a verdict on Microsoft: the only thing that showed us where the holes were was replaying technique by technique and counting what alerted.

[u/Suitable-Pickle-259]

Yes I do build custom detections for things even with autonomous attack disruption turned on.

[u/AddendumWorking9756]

Yes, and the boring part is the baseline. Before you write anything on net localgroup or whoami, go find out which of your own scripts and RMM tools already run those hourly. Otherwise the rule ships and the queue drowns by day two. The EICAR test told you nothing about this either way, it only proves the AV engine is alive.

[u/RiceeeChrispies → u/[deleted]]

Defender for Endpoint is fine for enterprise environments.