{"id":"ec19ebab-72dc-40e1-9728-4c0b805d722c","title":"Tamper Windows Defender - PSClassic","description":"Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-06-07","modified":"2024-01-02","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","category":"ps_classic_provider_start"},"falsepositives":["Legitimate PowerShell scripts that disable Windows Defender for troubleshooting purposes. Must be investigated."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml","source_sha256":"cf87fbf0e4c3a33baa3ed28ad213a8ab49ea205cfa8a099378754697d386b434","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Tamper Windows Defender - PSClassic\nid: ec19ebab-72dc-40e1-9728-4c0b805d722c\nrelated:\n    - id: 14c71865-6cd3-44ae-adaa-1db923fae5f2\n      type: similar\nstatus: test\ndescription: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-06-07\nmodified: 2024-01-02\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    category: ps_classic_provider_start\ndetection:\n    selection_set_mppreference:\n        Data|contains: 'Set-MpPreference'\n    selection_options_bool_allow:\n        Data|contains:\n            - '-dbaf $true'\n            - '-dbaf 1'\n            - '-dbm $true'\n            - '-dbm 1'\n            - '-dips $true'\n            - '-dips 1'\n            - '-DisableArchiveScanning $true'\n            - '-DisableArchiveScanning 1'\n            - '-DisableBehaviorMonitoring $true'\n            - '-DisableBehaviorMonitoring 1'\n            - '-DisableBlockAtFirstSeen $true'\n            - '-DisableBlockAtFirstSeen 1'\n            - '-DisableCatchupFullScan $true'\n            - '-DisableCatchupFullScan 1'\n            - '-DisableCatchupQuickScan $true'\n            - '-DisableCatchupQuickScan 1'\n            - '-DisableIntrusionPreventionSystem $true'\n            - '-DisableIntrusionPreventionSystem 1'\n            - '-DisableIOAVProtection $true'\n            - '-DisableIOAVProtection 1'\n            - '-DisableRealtimeMonitoring $true'\n            - '-DisableRealtimeMonitoring 1'\n            - '-DisableRemovableDriveScanning $true'\n            - '-DisableRemovableDriveScanning 1'\n            - '-DisableScanningMappedNetworkDrivesForFullScan $true'\n            - '-DisableScanningMappedNetworkDrivesForFullScan 1'\n            - '-DisableScanningNetworkFiles $true'\n            - '-DisableScanningNetworkFiles 1'\n            - '-DisableScriptScanning $true'\n            - '-DisableScriptScanning 1'\n            - '-MAPSReporting $false'\n            - '-MAPSReporting 0'\n            - '-drdsc $true'\n            - '-drdsc 1'\n            - '-drtm $true'\n            - '-drtm 1'\n            - '-dscrptsc $true'\n            - '-dscrptsc 1'\n            - '-dsmndf $true'\n            - '-dsmndf 1'\n            - '-dsnf $true'\n            - '-dsnf 1'\n            - '-dss $true'\n            - '-dss 1'\n    selection_options_actions_func:\n        Data|contains:\n            - 'HighThreatDefaultAction Allow'\n            - 'htdefac Allow'\n            - 'LowThreatDefaultAction Allow'\n            - 'ltdefac Allow'\n            - 'ModerateThreatDefaultAction Allow'\n            - 'mtdefac Allow'\n            - 'SevereThreatDefaultAction Allow'\n            - 'stdefac Allow'\n    condition: selection_set_mppreference and 1 of selection_options_*\nfalsepositives:\n    - Legitimate PowerShell scripts that disable Windows Defender for troubleshooting purposes. Must be investigated.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/ec19ebab-72dc-40e1-9728-4c0b805d722c.json","kind":"sigma"}