{"id":"a7ee1722-c3c5-aeff-3212-c777e4733217","title":"Disable Windows Defender AV Security Monitoring","description":"Detects attackers attempting to disable Windows Defender using Powershell","author":"ok @securonix invrep-de, oscd.community, frack113","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-18","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice."],"references":["https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/","https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml","source_sha256":"02441fc165285c1cad57396befd36e0f7e5ea17e824c94f3fbfc48d96dc788ee","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Windows Defender AV Security Monitoring\nid: a7ee1722-c3c5-aeff-3212-c777e4733217\nstatus: test\ndescription: Detects attackers attempting to disable Windows Defender using Powershell\nreferences:\n    - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/\n    - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: 'ok @securonix invrep-de, oscd.community, frack113'\ndate: 2020-10-12\nmodified: 2022-11-18\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_pwsh_binary:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_pwsh_cli:\n        CommandLine|contains:\n            - '-DisableBehaviorMonitoring $true'\n            - '-DisableRuntimeMonitoring $true'\n    selection_sc_binary:\n        - Image|endswith: '\\sc.exe'\n        - OriginalFileName: 'sc.exe'\n    selection_sc_tamper_cmd_stop:\n        CommandLine|contains|all:\n            - 'stop'\n            - 'WinDefend'\n    selection_sc_tamper_cmd_delete:\n        CommandLine|contains|all:\n            - 'delete'\n            - 'WinDefend'\n    selection_sc_tamper_cmd_disabled:\n        CommandLine|contains|all:\n            - 'config'\n            - 'WinDefend'\n            - 'start=disabled'\n    condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)\nfalsepositives:\n    - 'Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.'\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/a7ee1722-c3c5-aeff-3212-c777e4733217.json","kind":"sigma"}