Create ClickFix Defense Evasion

DefenderXDR/7-Zip Arbritrary File Write to Sensitive Location.kql

@@ -0,0 +1,14 @@
+// contact@ccaves.net for questions or contact
+// 7-Zip Arbritrary File Write to Sensitive Location
+
+DeviceFileEvents
+| where InitiatingProcessFileName has_any (@"7z.exe", @"7zG.exe", @"7zFM.exe")
+| where FileName endswith ".exe"
+    or FileName endswith ".dll"
+    or FileName endswith ".bat"
+    or FileName endswith ".cmd"
+    or FileName endswith ".ps1"
+    or FileName endswith ".vbs"
+    or FileName endswith ".iso"
+| where FolderPath has_any (@"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\", @"\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\", @"\Windows\System32\", @"\Windows\SysWOW64\", @"\Windows\Tasks\", @"\Windows\Temp\")
+| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, InitiatingProcessCommandLine, DeviceId, ReportId

DefenderXDR/7-Zip Spawning Suspicious Child Process.kql

@@ -0,0 +1,8 @@
+// contact@ccaves.net for questions or contact
+//7-Zip Spawning Suspicious Child Process
+
+DeviceProcessEvents
+| where InitiatingProcessCommandLine has_any (@"\7z.exe", @"\7zG.exe", @"\7zFM.exe")
+    or InitiatingProcessParentFileName has_any (@"\7z.exe", @"\7zG.exe", @"\7zFM.exe")
+| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "bash.exe")
+| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName, DeviceId, ReportId

DefenderXDR/ClickFix Defense Evasion

@@ -0,0 +1,6 @@
+//ClickFix Defense Evasion Checking for the use of 'SetClipboard -value " "'
+
+DeviceProcessEvents
+| Where ProcessCommandLine has_all ("set-clipboard", "-value")
+| where ProcessCommandLine has_any ('" "', "' '")
+| project AccountName, ProccessCommandLine

DefenderXDR/ClickFix Defense Evasion (DeviceEvents))

@@ -0,0 +1,8 @@
+// An alternate and slightly more succesful way of catching even obfuscated clipboard clearing. This technique is used for defense evasion with clickfix attacks.
+// This detection can be ran in Defender NRT for quick response.
+
+DeviceEvents
+| extend Command =  tolower(parse_json(AdditionalFields)["Command"])
+| where Command has_all ("set-clipboard", "-value")
+| where Command has_any ("' '", '" "')
+| project Timestamp, InitiatingProcessAccountName, parse_json(AdditionalFields)["Command"], DeviceId, ReportId