{"id":"51cbac1e-eee3-4a90-b1b7-358efb81fa0a","title":"Potential Windows Defender Tampering Via Wmic.EXE","description":"Detects potential tampering with Windows Defender settings such as adding exclusion using wmic","author":"frack113","status":"test","level":"high","date":"2022-12-11","modified":"2023-02-14","tags":["attack.execution","attack.defense-impairment","attack.t1047","attack.t1685"],"technique_ids":["T1047","T1685"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md","https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/","https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml","source_sha256":"c9a86aec4376680f12e5593945773462279b8db848c6dd9dfa7c09b3d274b444","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Windows Defender Tampering Via Wmic.EXE\nid: 51cbac1e-eee3-4a90-b1b7-358efb81fa0a\nstatus: test\ndescription: Detects potential tampering with Windows Defender settings such as adding exclusion using wmic\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md\n    - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/\n    - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/\nauthor: frack113\ndate: 2022-12-11\nmodified: 2023-02-14\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1047\n    - attack.t1685\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - OriginalFileName: 'wmic.exe'\n        - Image|endswith: '\\WMIC.exe'\n    selection_cli:\n        CommandLine|contains: '/Namespace:\\\\\\\\root\\\\Microsoft\\\\Windows\\\\Defender'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nsimulation:\n    - type: atomic-red-team\n      name: WMIC Tamper with Windows Defender Evade Scanning Folder\n      technique: T1562.001\n      atomic_guid: 59d386fc-3a4b-41b8-850d-9e3eee24dfe4\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/51cbac1e-eee3-4a90-b1b7-358efb81fa0a.json","kind":"sigma"}