Windows Downgrade Detections, Vanishing Updates (Part 2)
Time for part 2 of a few blogposts on threat actors disabling Windows updates. We covered why in the last post along with how, this time around we will be mostly focusing on detections.
We aren't just detecting disabled Windows updates though, we're detecting the steps required to actually delete and remove installed updates.
First we look at usage of the Windows native binary takeown, which enables an administrator to recover access to files that was previously denied.
In this case we are looking at takeown grabbing access of folders relating to Windows updates
Our Splunk search looks like this:
index=winlogs EventCode=4688 Process_Command_Line
IN ("*\Windows 10 install\*", "*\Windows10Upgrade\*")
New_Process_Name="*\\takeown.
| stats min(_time) AS earliest max(_time) AS latest count(Process_Command_Line) AS Count values(Process_Command_Line) AS Process_Command_Line BY Creator_Process_Name Account_Name ComputerName
| convert ctime(earliest) ctime(latest)
And the results, if something similar to Tarik Seyceri's Windows 10 update disable script has been run on a system, look like this:
To explain the command line we are seeing there, /F is specifying files or directories, /R performs the operation recursively, /A gives ownership to the Administrators group instead of the current user, /D suppresses the confirmation prompt that is displayed when the current user does not have the List Folder permission on a specified directory and finally Y is passed with that /D flag to confirm that you want ownership.
So the TA has taken access of these Windows update related folders, what next?
To understand the next detections we should understand what we are detecting, in this case usage of the Windows native binary cacls.exe, or icacls, the successor.
I'm going to be lazy here and quote Wikipedia, forgive me, it has been a long week.
"In Microsoft Windows, cacls and its replacement, icacls, native
command-line utilities capable of displaying and modifying the security
descriptors on folders and files. An access-control list is a list of
permissions for securable object, such as a file or folder, that
controls who can access it."
So with that in mind, let's look at two events.
So above we have cacls performing some kind of change on the Windows 10 install directory.
And above we have cacls performing the same changes on the Windows10Upgrade folder.
What changes is it making to both? /T changes access control for the directory specified and all subdirectories, /grant administrators is granting control to administrators and :F specified full control of all contents. This is the prerequisite to deleting the contents of both folders, essentially removing updates from Windows.
Here's how we can search for this behaviour in Splunk:
index=winlogs EventCode=4688 New_Process_Name="*\\cacls.exe" Process_Command_Line IN ("*\Windows 10 install\*", "*\Windows10Upgrade\*")
| stats min(_time) AS earliest max(_time) AS latest count(Process_Command_Line) AS Count values(Process_Command_Line) AS Process_Command_Line BY Creator_Process_Name Account_Name ComputerName
| convert ctime(earliest) ctime(latest)
| table earliest latest ComputerName Account_Name Creator_Process_Name New_Process_Name Process_Command_Line
Here is what that looks like in Splunk.
The deletion itself does not spawn a subprocess as it is a built in function of cmd cli but we can still base detections on the above and look for changes relating to Windows system folders.
I think there'll be at least one more blog post on this topic as I am finding it really interesting, so keep your eyes peeled for that.
