valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Create sysmon_disabled_pua_protection_on_microsoft_defender.yml

Browse Source
This commit is contained in:
Austin Songer 2021-08-04 11:27:41 -05:00 committed by GitHub
parent 28abe88927
commit f89ba18c5d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/windows/registry_event/sysmon_disabled_pua_protection_on_microsoft_defender.yml Normal file
View File

@ -0,0 +1,24 @@
title: Disable PUA Protection on Windows Defender
id: 8ffc5407-52e3-478f-9596-0a7371eafe13
description: Detects disabling Windows Defender PUA protection
status: experimental
date: 2021/08/04
author: Austin Songer @austinsonger
references:
- https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
tags:
- attack.defense_evasion
logsource:
category: registry_event
product: windows
detection:
selection:
EventType: SetValue
TargetObject|contains: 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender'
TargetObject|endswith:
- PUAProtection
Details: 'DWORD (0x00000000)'
condition: selection
falsepositives:
- Unknown
level: high