Microsoft Defender Blocked from Loading Unsigned DLL

Title: Microsoft Defender Blocked from Loading Unsigned DLL
Status: test
Description:Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL
References:
  -https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
Author: Bhabesh Raj
Date: 2022-08-02
modified:2022-09-28
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• product: windows
• service: security-mitigations

Detection:
  selection:
    EventID:
      -'11'
      -'12'

    ProcessPath|endswith:
      -'\MpCmdRun.exe'
      -'\NisSrv.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high