EDR Bluespawn (free)

Author: Stefan Waldvogel

-under construction-
BLUESPAWN is an active defense and endpoint detection and response tool which means it can be used by defenders to quickly detect, identify, and eliminate malicious activity and malware across a network.
To follow this guide, you can use your Windows 10 VM. If you do not have one, you can follow this guide to create a machine

Windows in a VM

To follow all steps, you can install Atomic Red Team before you proceed with the installation of Bluespawn:

Atomic Red Team

GitHub:
github.com/ION28/BLUESPAWN

Downloadlink:
https://github.com/ION28/BLUESPAWN/releases (all releases)
github.com/ION28/BLUESPAWN/releases/tag/v0.5.1-alpha (used version in this guide)
Download the client x64.exe

Depending on your system, you have to turn off Microsoft defender. --> To play around, do not user your main system!
You can use the GUI or a powershell command to turn Defender off. The command is:
Set-MpPreference -DisableRealtimeMonitoring $true

Windows 10 is changing a lot, you might have to whitelist the program if the PowerShell command does not work.

Bluespan has three different modes:

mitigate
hunt
monitor

For the next tests, we use monitor, but if you are interested in the other modes, use the GitHub link to read more about them.
Open a command line (cmd) with administrator rights and point the cursor to your Bluespawn.exe

The command to start monitoring is:
.\BLUESPAWN-client-x64.exe --monitor -a Cursory

At the moment, nothing happens, therefore we can dive into the given output. Bluespawn (and Atomic Red Team) is based on MITRE and we see matching numbers here. T1136 is about creating a user account. We find more information here: attack.mitre.org/techniques/T1136/
The article mentions EventID 4720. Let us create a user via Computer Management and observe everything. We will not see anything, because we do not log this event.

We have to edit the Group Policy (again), because a different policy overwrite this setting.

At least in my version, Bluespawn is crashing after creating a user. Bluespawn is an alpha version, this is okay. We can try something else.
What about T1036 (Masquerading)?
The matching command is:
Invoke-AtomicTest T1036.003 -ShowDetailsBrief

First, we check if we need something for this atomic:
Invoke-AtomicTest T1036.003 -TestName 1 -CheckPrereqs

we need a folder, that is not a problem:
Invoke-AtomicTest T1036.003 -TestName 1 -GetPrereqs

Now, we have everything for our small test and we can run Bluespawn again.

The test command is:
Invoke-AtomicTest T1036 -TestName 1