SigmaHQ/rules/windows/powershell/powershell_tamper_with_windows_defender.yml
2021-06-07 20:27:14 +02:00

30 lines
925 B
YAML

title: Tamper Windows Defender
id: ec19ebab-72dc-40e1-9728-4c0b805d722c
description: Attempting to disable scheduled scanning and other parts of windows defender atp.
status: experimental
tags:
- attack.defense_evasion
- attack.t1562.001
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
author: frack113
date: 2021/06/07
falsepositives:
- Unknown
level: high
logsource:
product: windows
category: powershell-classic
detection:
select_EventID:
EventID: 600
tamper_ps_action:
HostApplication|contains: 'Set-MpPreference'
tamper_ps_option:
HostApplication|contains:
- '-DisableRealtimeMonitoring 1'
- '-DisableBehaviorMonitoring 1'
- '-DisableScriptScanning 1'
- '-DisableBlockAtFirstSeen 1'
condition: select_EventID and tamper_ps_action and tamper_ps_option