Defender for Endpoint (MDE) Advanced Hunting Queries

Production threat hunting queries for Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceRegistryEvents) across Windows and macOS Intune-managed devices.

---

🗡️ 1. Living Off The Land Binaries (LOLBins) Abused for Download (Windows)

• 🎯 What it looks for: Native, trusted Microsoft-signed executables (certutil.exe, bitsadmin.exe, mshta.exe, certreq.exe) executing with command-line switches indicating remote file downloads (http://, https://, /transfer, urlcache, split).
• 💡 Why it matters: Attackers abuse legitimate Windows binaries (LOLBAS) to download secondary payloads, C2 stagers, and infostealers. Because the executables themselves are valid Microsoft components, traditional application control and basic antivirus often fail to flag them unless the command-line parameters are inspected.

let Lookback = 7d;
let SuspectUtilities = dynamic([
    "certutil.exe", "bitsadmin.exe", "mshta.exe",
    "certreq.exe", "hh.exe", "regsvr32.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (SuspectUtilities)
| where ProcessCommandLine has_any ("http://", "https://", "ftp://", "urlcache", "split", "/transfer")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

---

🔑 2. LSASS Access & Suspicious Process Injection

• 🎯 What it looks for: Non-system, third-party processes requesting handle rights to lsass.exe with memory read access masks (0x10, 0x1010, 0x1410, 0x1F0FFF), while excluding trusted security software like Defender (MsMpEng.exe).
• 💡 Why it matters: The Local Security Authority Subsystem Service (lsass.exe) caches user credentials, Kerberos tickets, and NT hashes in volatile memory. Credential dumping tools (Mimikatz, procdump, Dumpert, Nanodump) must open a handle to LSASS with read permissions to extract plaintext secrets or password hashes for credential theft.

DeviceEvents
| where Timestamp > ago(3d)
| where ActionType == "OpenProcessApiCall"
| where FileName =~ "lsass.exe"
| where AdditionalFields.DesiredAccess in ("0x1010", "0x1410", "0x1F0FFF", "0x0010")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "SenseIR.exe", "csrss.exe", "svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields
| sort by Timestamp desc

---

⚡ 3. Obfuscated & Base64 PowerShell Execution

• 🎯 What it looks for: PowerShell instances launched with flags that bypass execution policy, suppress UI windows, download external strings directly into memory, or execute Base64-encoded command blocks (-enc, -encodedcommand, downloadstring, iex).
• 💡 Why it matters: Adversaries commonly execute payloads “filelessly” by staging encoded commands directly in RAM. By invoking Invoke-Expression (iex) or downloading scripts directly from a web socket, the attacker leaves zero binary artifacts on disk, attempting to evade static file scanners.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "-e ", "downloadstring", "invoke-expression", "iex", "webclient", "bitstransfer")
| extend EncodedPayload = extract(@"-(?:e|enc|encodedcommand)\s+([A-Za-z0-9+/=]+)", 1, ProcessCommandLine, typeof(string))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, EncodedPayload, InitiatingProcessFileName
| sort by Timestamp desc

---

🌲 4. Anomalous Parent-Child Process Relationships

• 🎯 What it looks for: Interactive command shells (cmd.exe, powershell.exe, bash.exe) or script runners (wscript.exe, cscript.exe) spawned as direct child processes of web application pools (w3wp.exe, httpd.exe, nginx.exe) or productivity apps (winword.exe, excel.exe, outlook.exe).
• 💡 Why it matters: Productivity applications and web servers should never launch interactive command prompts under normal business operations. When Word or Excel spawns a shell, it represents malicious macro execution or document exploit delivery. When a web server spawns a shell, it indicates an active web shell backdoor or remote code execution (RCE) exploit.

let Lookback = 14d;
let OfficeApps = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe"]);
let WebServers = dynamic(["w3wp.exe", "httpd.exe", "nginx.exe", "tomcat.exe"]);
let ChildShells = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "bash.exe"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ (OfficeApps) or InitiatingProcessFileName in~ (WebServers)
| where FileName in~ (ChildShells)
| project Timestamp, DeviceName, AccountName,
    SuspiciousParent = InitiatingProcessFileName,
    ChildProcess = FileName,
    ProcessCommandLine,
    InitiatingProcessCommandLine
| sort by Timestamp desc

---

🍎 5. macOS Threat Hunting (Intune-Managed Macs)

A. Detecting Malicious Shell Execution Piped to Curl / Osascript

• 🎯 What it looks for: Shell instances (bash, zsh, sh, python3) on macOS endpoints spawning utilities like osascript (AppleScript execution), curl, or wget with Base64 decode flags or prompt phishing strings (display dialog).
• 💡 Why it matters: Modern macOS malware (e.g. Atomic Stealer, Cthulhu Stealer, MacStealer) uses fake AppleScript GUI dialogs to prompt users for their macOS administrator password. Once captured, the malware pipes stolen credentials and keychains directly to remote servers via curl.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ActionType == "ProcessCreated"
| where InitiatingProcessFileName in~ ("bash", "zsh", "sh", "python3") or FileName in~ ("osascript", "curl", "launchctl")
| where ProcessCommandLine has_any ("curl", "wget", "osascript -e", "display dialog", "base64 -d", "/bin/sh", "/bin/zsh")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| sort by Timestamp desc

B. Detecting Persistence via LaunchDaemons or LaunchAgents (.plist)

• 🎯 What it looks for: Creation or modification of .plist property list files in macOS autostart directories (/Library/LaunchDaemons, /Library/LaunchAgents, ~/Library/LaunchAgents).
• 💡 Why it matters: LaunchDaemons (run as root at boot) and LaunchAgents (run as user at login) are the primary persistence mechanism on macOS. Malicious scripts install a .plist file pointing to a hidden binary or reverse shell to survive reboots and maintain access.

DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any ("/Library/LaunchDaemons", "/Library/LaunchAgents", "~/Library/LaunchAgents")
| where FileName endswith ".plist"
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc