Windows Downgrade Detections, Updates Sabotage Dire Straits (Part 1)
There is never necessarily a good time for Windows updates, but if you are running Windows and care about security, you're going to have to do it eventually, right?
Some Threat Actors would prefer that those updates remain uninstalled though, this blog and the research that went into it is inspired by this Scadafence paper entitled "Anatomy of a Targeted Ransomware Attack" which includes this list, pay particular attention to 2.
"Disabling Windows updates", this got me thinking. I had a look through ATT&CK to try to map this TTP but to no avail, asking in the ATT&CK Slack I think "Impair Defenses: Disable or Modify Tools" (T1562.001) or "Service Stop" (T1489) seem most appropriate, but I'll leave it up to you as it could fit under a few techniques.
I couldn't find any detections for this, so I decided to make my own and share them.
Why would a threat actor want to stop Windows updates or even roll them back? I think TAs, especially in the ransomware space, frequently find themselves chasing recent publicised vulnerabilities before they are patched. If persistence or backup methods of accessing the affected system have not been established you want to make sure that patching will not prevent a repeat of initial access, if the vulnerability is how that was achieved. Personally I think this could also be really useful inside of an enterprise network, because leaving an internet facing system vulnerable to a recent exploit is just asking for other TAs to rain on your parade.
For this blog I've used a batch file by "Windows 10 Update Disabler", then the resulting event data is ingested into Splunk. Because vanilla Windows event logging is so predictable though, both in format and content, these detections could easily be retrofitted for Sentinel, elastic, Defender 365 Advanced Hunting queries or the SIEM platform of your choice.
In this blog we are going to look at good old EventID 4688, I'll write a couple follow ups to cover other EventIDs. Specifically we are looking to changes to scheduled tasks using schtasks.exe which as we all know I'm sure enables someone to create, delete, query, change, run, and end scheduled tasks on a local or remote computer.
Here is the SPL (change out the index for where you keep your Windows event logs)
index=winlogs EventCode=4688 New_Process_Name=*\\schtasks. | stats min(_time) AS earliest max(_time) AS latest count(Process_Command_Line) AS Count values(Process_Command_Line) AS Process_Command_Line BY New_Process_Name, Creator_Process_Name, Account_Name, ComputerName | convert ctime(earliest) ctime(latest) | table earliest latest Account_Name ComputerName Creator_Process_Name New_Process_Name Process_Command_Line | |||||
| And here is what it looks like in Splunk: | |||||
"UpdateAssistant" is a Windows 10 tool that downloads and installs "feature" updates on your device, the first 3 disabled tasks on the above list all revolve around that functionality. The next two are clearly Windows Update related, the last two relate specifically to "Silent Install Helper", which installs updates in the background.
There'll be a part 2 and 3 of this, at least, soon enough, just need the time to setup and properly configure logging on another VM and run through the resulting data.
