{"id":"c6fb44c6-71f5-49e6-9462-1425d328aee3","title":"Powershell Base64 Encoded MpPreference Cmdlet","description":"Detects base64 encoded \"MpPreference\" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-04","modified":"2023-01-30","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md","https://twitter.com/AdamTheAnalyst/status/1483497517119590403"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml","source_sha256":"e7ce2f3545919f5f03bd0e0481e578b5b1f61a19a98cf08ce6333d4357bd9e3a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Powershell Base64 Encoded MpPreference Cmdlet\nid: c6fb44c6-71f5-49e6-9462-1425d328aee3\nstatus: test\ndescription: Detects base64 encoded \"MpPreference\" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV\nreferences:\n    - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\n    - https://twitter.com/AdamTheAnalyst/status/1483497517119590403\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-04\nmodified: 2023-01-30\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - CommandLine|base64offset|contains:\n              - 'Add-MpPreference '\n              - 'Set-MpPreference '\n              - 'add-mppreference '\n              - 'set-mppreference '\n        - CommandLine|contains:\n              # UTF16-LE\n              - 'QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'\n              - 'EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'\n              - 'BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'\n              - 'UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'\n              - 'MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'\n              - 'TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'\n              - 'YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'\n              - 'EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'\n              - 'hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'\n              - 'cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'\n              - 'MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'\n              - 'zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/c6fb44c6-71f5-49e6-9462-1425d328aee3.json","kind":"sigma"}