Title:
Disable Windows Defender AV Security Monitoring
Status:
test
Description:Detects attackers attempting to disable Windows Defender using Powershell
References:
-https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
-https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
-https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Author: ok @securonix invrep-de, oscd.community, frack113
Date: 2020-10-12
modified:2022-11-18
Tags:
- -'attack.defense-impairment'
- -'attack.t1685'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_pwsh_binary:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_pwsh_cli:
CommandLine|contains:
-'-DisableBehaviorMonitoring $true'
-'-DisableRuntimeMonitoring $true'
selection_sc_binary:
Image|endswith:
'\sc.exe'
OriginalFileName:
'sc.exe'
selection_sc_tamper_cmd_stop:
CommandLine|contains|all:
-'stop'
-'WinDefend'
selection_sc_tamper_cmd_delete:
CommandLine|contains|all:
-'delete'
-'WinDefend'
selection_sc_tamper_cmd_disabled:
CommandLine|contains|all:
-'config'
-'WinDefend'
-'start=disabled'
condition:
all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)
Falsepositives:
-Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.
Level:
high
