
title: Tamper Windows Defender
author: frack113
date: 2021/06/07
description: Attempting to disable scheduled scanning and other parts of windows defender
  atp.
detection:
  SELECTION_1:
    HostApplication: '*Set-MpPreference*'
  SELECTION_2:
    HostApplication:
    - '*-DisableRealtimeMonitoring 1*'
    - '*-DisableBehaviorMonitoring 1*'
    - '*-DisableScriptScanning 1*'
    - '*-DisableBlockAtFirstSeen 1*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unknown
id: ec19ebab-72dc-40e1-9728-4c0b805d722c
level: high
logsource:
  category: ps_classic_provider_start
  definition: fields have to be extract from event
  product: windows
modified: 2021/10/16
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
status: experimental
tags:
- attack.defense_evasion
- attack.t1562.001
ruletype: SIGMA
