Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "testsigning" and ProcessCommandLine contains "on" | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc

let window = 30m; // 1) bcdedit invocations that enable test signing let BcdEditEnableCmds = DeviceProcessEvents | where tolower(FileName) in ("bcdedit.exe", "bcdedit") or ProcessCommandLine has "bcdedit" | where ProcessCommandLine matches regex @"(?i)\bbcdedit(?:\.exe)?\b.*?(?:/|-)?set\b.*?\btestsigning\b.*?\b(on|yes|true|1)\b" | project DeviceId, DeviceName, BcdEditTime=TimeGenerated, BcdEditPid=ProcessId, BcdEditFileName=FileName, BcdEditFolderPath=FolderPath, BcdEditCmd=ProcessCommandLine, BcdEditElevation=ProcessTokenElevation, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessParentFileName, InitiatingProcessParentId; // 2) BCD hive registry activity (evidence that BCD changed) let BcdRegWrites = DeviceRegistryEvents | where tolower(RegistryKey) has "\\bcd00000000\\objects\\" and tolower(RegistryKey) has "\\elements\\" | where ActionType in ("RegistryValueSet","RegistryValueCreate","RegistryKeyCreated","RegistryKeyModified","RegistryKeyRestored","RegistryValueDeleted","RegistryKeyDeleted") | extend ElementId = tostring(extract(@"\\elements\\([0-9a-f]{8})\\", 1, tolower(RegistryKey))) | project RegTime=TimeGenerated, DeviceId, DeviceName, ActionType, RegistryKey, ElementId, RegistryValueName, RegistryValueData, WriterProcessFileName=InitiatingProcessFileName, WriterProcessId=InitiatingProcessId, WriterProcessCommandLine=InitiatingProcessCommandLine, WriterProcessParentFileName=InitiatingProcessParentFileName, WriterProcessParentId=InitiatingProcessParentId, WriterAccountDomain=InitiatingProcessAccountDomain, WriterAccountName=InitiatingProcessAccountName, WriterAccountSid=InitiatingProcessAccountSid; // 3) Correlate bcdedit commands with nearby BCD writes; also include fallback when only registry writer is visible union ( BcdEditEnableCmds | join kind=leftouter (BcdRegWrites) on DeviceId | where isnull(RegTime) or RegTime between (BcdEditTime - window .. BcdEditTime + window) | extend BootEntry = tostring(extract(@"(?i)\{(current|default|globalsettings|[0-9a-f-]{36})\}", 1, BcdEditCmd)), RequestedState = tostring(extract(@"(?i)\\btestsigning\\b.*?\\b(on|yes|true|1)\\b", 1, BcdEditCmd)) | summarize RegEvents=countif(isnotnull(RegTime)), FirstRegTime=minif(RegTime, isnotnull(RegTime)), LastRegTime=maxif(RegTime, isnotnull(RegTime)), SampleRegKeys=make_set(RegistryKey, 5) by DeviceId, DeviceName, BcdEditTime, BcdEditPid, BcdEditFileName, BcdEditFolderPath, BcdEditCmd, BcdEditElevation, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessParentFileName, InitiatingProcessParentId, BootEntry, RequestedState ), ( // Fallback: attribute from the registry writer if its command line shows enabling Test Signing BcdRegWrites | where tostring(WriterProcessCommandLine) matches regex @"(?i)\bbcdedit(?:\.exe)?\b.*?(?:/|-)?set\b.*?\btestsigning\b.*?\b(on|yes|true|1)\b" | extend BcdEditTime=RegTime, BcdEditPid=WriterProcessId, BcdEditFileName=WriterProcessFileName, BcdEditFolderPath="", BcdEditCmd=WriterProcessCommandLine, BcdEditElevation="", InitiatingProcessFileName=WriterProcessParentFileName, InitiatingProcessId=WriterProcessParentId, InitiatingProcessCommandLine="", InitiatingProcessAccountDomain=WriterAccountDomain, InitiatingProcessAccountName=WriterAccountName, InitiatingProcessAccountSid=WriterAccountSid, BootEntry=tostring(extract(@"(?i)\{(current|default|globalsettings|[0-9a-f-]{36})\}", 1, WriterProcessCommandLine)), RequestedState=tostring(extract(@"(?i)\\btestsigning\\b.*?\\b(on|yes|true|1)\\b", 1, WriterProcessCommandLine)), RegEvents=1, FirstRegTime=RegTime, LastRegTime=RegTime, SampleRegKeys=pack_array(RegistryKey) | project DeviceId, DeviceName, BcdEditTime, BcdEditPid, BcdEditFileName, BcdEditFolderPath, BcdEditCmd, BcdEditElevation, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessParentFileName=WriterProcessParentFileName, InitiatingProcessParentId=WriterProcessParentId, BootEntry, RequestedState, RegEvents, FirstRegTime, LastRegTime, SampleRegKeys ) | summarize arg_max(BcdEditTime, *) by DeviceId, BcdEditCmd | order by BcdEditTime desc

DeviceProcessEvents | where FileName =~ "bcdedit.exe" or ProcessCommandLine has "bcdedit" | where ProcessCommandLine has_any ("testsigning", "TestSigning", "TESTSIGNING") | order by TimeGenerated desc | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, AccountDomain, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessTokenElevation

// Combine registry events for BCD store changes and processes that ran bcdedit // to see who or what turned on test signing mode union ( DeviceRegistryEvents | where ActionType in ("SetValue", "ModifyValue", "CreateValue") // Look for references to the BCD store or test signing in the registry | where RegistryKey has "BCD" or RegistryValueData has "testsigning" | project TimeGenerated, DeviceId, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName ), ( DeviceProcessEvents // Look for a process that actually ran bcdedit with a test signing parameter | where FileName =~ "bcdedit.exe" or ProcessCommandLine has "bcdedit" | where ProcessCommandLine has "testsigning" // Focus on enabling test signing | project TimeGenerated, DeviceId, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName ) | order by TimeGenerated desc

// ======================================================================== // Test-signing mode investigation: who enabled it and with what command // // ======================================================================== // (Time range will be applied by the hunting portal; uncomment next line // if you want to test it manually) // | where TimeGenerated between (ago(7d) .. now()) // 1. Registry evidence that the TESTSIGNING element was set in the BCD let RegistryChanges = DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryKeyWritten", "SetValue", "CreateKey") | where RegistryKey has "\\BCD" // Boot Configuration Data hive | where RegistryValueName has_cs "TESTSIGNING" or RegistryValueData has_cs "TESTSIGNING" | project DeviceId, DeviceName, RegistryEventTime = TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, RegInitiatingProcessPath = strcat(InitiatingProcessFolderPath, "\\", InitiatingProcessFileName), RegInitiatingProcessCommandLine = InitiatingProcessCommandLine, RegInitiatingProcessSHA256 = InitiatingProcessSHA256, RegInitiatingProcessId = InitiatingProcessId, RegUser = strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName); // 2. Actual executions of bcdedit intended to enable test-signing let BcdeditRuns = DeviceProcessEvents | where FileName =~ "bcdedit.exe" // bcdedit execution | where ProcessCommandLine contains "testsigning" // mentions TESTSIGNING | where ProcessCommandLine matches regex @"(?i)\b(on|yes|enable|1)\b" // enabling it | project DeviceId, DeviceName, ProcessTime = TimeGenerated, BcdeditCommandLine = ProcessCommandLine, BcdeditPath = strcat(FolderPath, "\\", FileName), ProcSHA256 = SHA256, ProcessId, ProcUser = strcat(AccountDomain, "\\", AccountName); // 3. Correlate the two artefacts (same host, within ±10 minutes) RegistryChanges | join kind=fullouter BcdeditRuns on DeviceId | extend TimeDeltaMin = iif(isnotempty(RegistryEventTime) and isnotempty(ProcessTime), abs(datetime_diff("minute", RegistryEventTime, ProcessTime)), long(null)) | where isnull(TimeDeltaMin) or TimeDeltaMin <= 10 | project EventTime = coalesce(RegistryEventTime, ProcessTime), DeviceName, DeviceId, // Registry side RegistryKey, RegistryValueName, RegistryValueData, RegInitiatingProcessPath, RegInitiatingProcessCommandLine, RegInitiatingProcessSHA256, // Process side BcdeditPath, BcdeditCommandLine, ProcSHA256, // Who did it User = coalesce(RegUser, ProcUser), TimeDeltaMin | order by EventTime desc

let RegistryEvents = DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where (tolower(RegistryKey) contains "boot" or tolower(RegistryKey) contains "bcd") | where (tolower(RegistryValueName) contains "testsign" or tolower(RegistryValueData) contains "on") | where isnotempty(InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine; let ProcessEvents = DeviceProcessEvents | where tolower(ProcessCommandLine) contains "bcdedit" | where tolower(ProcessCommandLine) contains "testsign" | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine; RegistryEvents | union ProcessEvents | order by TimeGenerated desc

union withsource = TableName DeviceRegistryEvents, DeviceProcessEvents | where ((InitiatingProcessCommandLine contains "bcdedit" or InitiatingProcessCommandLine contains "testsign") or (ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "testsign")) | extend CommandLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | project TimeGenerated, DeviceName, TableName, CommandLine, InitiatingProcessId, ProcessId, RegistryKey, RegistryValueName, RegistryValueData | sort by TimeGenerated desc

let regEvents = DeviceRegistryEvents | where ActionType == "SetValue" and RegistryKey contains "BCD00000000" and tolower(RegistryValueName) contains "testsign" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData; let procEvents = DeviceProcessEvents | where tolower(FileName) endswith "bcdedit.exe" and tolower(ProcessCommandLine) contains "testsign" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName = FileName, InitiatingProcessId = ProcessId, InitiatingProcessCommandLine = ProcessCommandLine, RegistryKey = "(n/a)", RegistryValueName = "(n/a)", RegistryValueData = "(n/a)"; regEvents | union procEvents | sort by TimeGenerated desc