Techniques
Sample rules
Powershell Defender Disable Scan Feature
- source: sigma
- technicques:
- t1562
- t1562.001
Description
Detects requests to disable Microsoft Defender features using PowerShell commands
Detection logic
condition: all of selection_cli_* or 1 of selection_encoded_*
selection_cli_cmdlet:
CommandLine|contains:
- 'Add-MpPreference '
- 'Set-MpPreference '
selection_cli_option:
CommandLine|contains:
- 'DisableArchiveScanning '
- 'DisableRealtimeMonitoring '
- 'DisableIOAVProtection '
- 'DisableBehaviorMonitoring '
- 'DisableBlockAtFirstSeen '
- 'DisableCatchupFullScan '
- 'DisableCatchupQuickScan '
selection_cli_value:
CommandLine|contains:
- $true
- ' 1 '
selection_encoded_direct:
CommandLine|contains:
- RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA
- QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA
- EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA
- RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA
- QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAA
- EAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgA
- RABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgA
- QAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIA
- EAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAA
- RABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAA
- QAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgA
- EAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIA
- ZABpAHMAYQBiAGwAZQByAGUAYQBsAHQAaQBtAGUAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA
- QAaQBzAGEAYgBsAGUAcgBlAGEAbAB0AGkAbQBlAG0AbwBuAGkAdABvAHIAaQBuAGcAIA
- kAGkAcwBhAGIAbABlAHIAZQBhAGwAdABpAG0AZQBtAG8AbgBpAHQAbwByAGkAbgBnACAA
- ZABpAHMAYQBiAGwAZQBpAG8AYQB2AHAAcgBvAHQAZQBjAHQAaQBvAG4AIA
- QAaQBzAGEAYgBsAGUAaQBvAGEAdgBwAHIAbwB0AGUAYwB0AGkAbwBuACAA
- kAGkAcwBhAGIAbABlAGkAbwBhAHYAcAByAG8AdABlAGMAdABpAG8AbgAgA
- ZABpAHMAYQBiAGwAZQBiAGUAaABhAHYAaQBvAHIAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA
- QAaQBzAGEAYgBsAGUAYgBlAGgAYQB2AGkAbwByAG0AbwBuAGkAdABvAHIAaQBuAGcAIA
- kAGkAcwBhAGIAbABlAGIAZQBoAGEAdgBpAG8AcgBtAG8AbgBpAHQAbwByAGkAbgBnACAA
- ZABpAHMAYQBiAGwAZQBiAGwAbwBjAGsAYQB0AGYAaQByAHMAdABzAGUAZQBuACAA
- QAaQBzAGEAYgBsAGUAYgBsAG8AYwBrAGEAdABmAGkAcgBzAHQAcwBlAGUAbgAgA
- kAGkAcwBhAGIAbABlAGIAbABvAGMAawBhAHQAZgBpAHIAcwB0AHMAZQBlAG4AIA
- RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAEYAdQBsAGwAUwBjAGEAbgA
- RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAFEAdQBpAGMAawBTAGMAYQBuAA
- RABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwA
selection_encoded_modifier:
CommandLine|base64offset|contains:
- 'disablearchivescanning '
- 'DisableArchiveScanning '
- 'disablebehaviormonitoring '
- 'DisableBehaviorMonitoring '
- 'disableblockatfirstseen '
- 'DisableBlockAtFirstSeen '
- 'disablecatchupfullscan '
- 'DisableCatchupFullScan '
- 'disablecatchupquickscan '
- 'DisableCatchupQuickScan '
- 'disableioavprotection '
- 'DisableIOAVProtection '
- 'disablerealtimemonitoring '
- 'DisableRealtimeMonitoring '
Powershell Defender Exclusion
- source: sigma
- technicques:
- t1562
- t1562.001
Description
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Detection logic
condition: all of selection*
selection1:
CommandLine|contains:
- 'Add-MpPreference '
- 'Set-MpPreference '
selection2:
CommandLine|contains:
- ' -ExclusionPath '
- ' -ExclusionExtension '
- ' -ExclusionProcess '
- ' -ExclusionIpAddress '