blue-team-tools/rules/windows/powershell/powershell_script/posh_ps_tamper_defender.yml

title: Suspicious Start-Process PassThru
id: 14c71865-6cd3-44ae-adaa-1db923fae5f2
related:
    - id: ec19ebab-72dc-40e1-9728-4c0b805d722c
      type: derived
status: experimental
description: Attempting to disable scheduled scanning and other parts of windows defender atp. Or set default actions to allow.
author: frack113, elhoim
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
    - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
    - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
date: 2022/01/16
modified: 2022/05/05
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_options_disabling:
        ScriptBlockText|contains|all:
            - 'Set-MpPreference'
            - ' 1'
        ScriptBlockText|contains:
            - DisableRealtimeMonitoring
            - DisableBehaviorMonitoring
            - DisableScriptScanning
            - DisableArchiveScanning
            - DisableBlockAtFirstSeen
            - DisableIOAVProtection
            - DisableIntrusionPreventionSystem
            - DisableRemovableDriveScanning
            - DisableScanningMappedNetworkDrivesForFullScan
            - DisableScanningNetworkFiles
    selection_default_actions_allow:
        ScriptBlockText|contains|all:
            - 'Set-MpPreference'
            - Allow
        ScriptBlockText|contains:
            - LowThreatDefaultAction
            - ModerateThreatDefaultAction
            - HighThreatDefaultAction
    condition: selection_options_disabling or selection_default_actions_allow
falsepositives:
    - Legitimate PowerShell scripts
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.001