title: Powershell Defender Base64 MpPreference
id: c6fb44c6-71f5-49e6-9462-1425d328aee3
status: experimental
description: Detects base64 encoded PowerShell code that modifies Windows Defender
references:
    - https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
    - https://twitter.com/AdamTheAnalyst/status/1483497517119590403
tags:
    - attack.defense_evasion
    - attack.t1562.001
author: Florian Roth
date: 2022/03/04
modified: 2022/03/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_encoded:
        CommandLine|base64offset|contains:
            - 'Add-MpPreference '
            - 'Set-MpPreference '
            - 'add-mppreference '
            - 'set-mppreference '
        CommandLine|contains:
            # UTF16-LE
            - 'QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
            - 'EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
            - 'BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
            - 'UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
            - 'MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
            - 'TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
            - 'YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
            - 'EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
            - 'hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
            - 'cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
            - 'MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
            - 'zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
    condition: selection_encoded
falsepositives:
    - Possible Admin Activity
    - Other Cmdlets that may use the same parameters
level: high
