Disable Windows Defender AV Security Monitoring — Sigma Rule

Rule metadata and linked tags

Author: ok @securonix invrep-de, oscd.community, frack113. Source status: test; severity: high. Source dates: 2020-10-12 / 2022-11-18.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 02441fc165285c1cad57396befd36e0f7e5ea17e824c94f3fbfc48d96dc788ee

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Disable Windows Defender AV Security Monitoring
id: a7ee1722-c3c5-aeff-3212-c777e4733217
status: test
description: Detects attackers attempting to disable Windows Defender using Powershell
references:
    - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
    - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
author: 'ok @securonix invrep-de, oscd.community, frack113'
date: 2020-10-12
modified: 2022-11-18
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh_binary:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_pwsh_cli:
        CommandLine|contains:
            - '-DisableBehaviorMonitoring $true'
            - '-DisableRuntimeMonitoring $true'
    selection_sc_binary:
        - Image|endswith: '\sc.exe'
        - OriginalFileName: 'sc.exe'
    selection_sc_tamper_cmd_stop:
        CommandLine|contains|all:
            - 'stop'
            - 'WinDefend'
    selection_sc_tamper_cmd_delete:
        CommandLine|contains|all:
            - 'delete'
            - 'WinDefend'
    selection_sc_tamper_cmd_disabled:
        CommandLine|contains|all:
            - 'config'
            - 'WinDefend'
            - 'start=disabled'
    condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)
falsepositives:
    - 'Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.'
level: high

Original YAML and metadata in JSON

False positives

• Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.

Source references

• https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
• https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md