Query: Sigma rule for Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set defau
Matching passage: Sigma rule: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set defau. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender - ScriptBlockLogging id: 14c71865-6cd3-44ae-adaa-1db923fae5f2 related: - id: ec19ebab-72dc-40e1-9728-4c0b805d722c type: derived status: test description: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-16 modified: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_options_disabling_preference: ScriptBlockText|contains: Set-MpPreference selection_options_disabling_function: ScriptBlockText|contains: - -dbaf $true - -dbaf 1 - -dbm $true - -dbm 1 - -dips $true - -dips 1 - -DisableArchiveScanning $true - -DisableArchiveScanning 1 - -DisableBehaviorMonitoring $true - -DisableBehaviorMonitoring 1 - -DisableBlockAtFirstSeen $true - -DisableBlockAtFirstSeen 1 - -DisableCatchupFullScan $true - -DisableCatchupFullScan 1 - -DisableCatchupQuickScan $true - -DisableCatchupQuickScan 1 - -DisableIntrusionPreventionSystem $true - -DisableIntrusionPreventionSystem 1 - -DisableIOAVProtection $true - -DisableIOAVProtection 1 - -DisableRealtimeMonitoring $true - -DisableRealtimeMonitoring 1 - -DisableRemovableDriveScanning $true - -DisableRemovableDriveScanning 1 - -DisableScanningMappedNetworkDrivesForFullScan $true - -DisableScanningMappedNetworkDrivesForFullScan 1 - -DisableScanningNetworkFiles $true - -DisableScanningNetworkFiles 1 - -DisableScriptScanning $true - -DisableScriptScanning 1 - -MAPSReporting $false - -MAPSReporting 0 - -drdsc $true - -drdsc 1 - -drtm $true - -drtm 1 - -dscrptsc $true - -dscrptsc 1 - -dsmndf $true - -dsmndf 1 - -dsnf $true - -dsnf 1 - -dss $true - -dss 1 selection_other_default_actions_allow: ScriptBlockText|contains: Set-MpPreference selection_other_default_actions_func: ScriptBlockText|contains: - HighThreatDefaultAction Allow - htdefac Allow - LowThreatDefaultAction Allow - ltdefac Allow - ModerateThreatDefaultAction Allow -
Near-miss passage: Sigma rule: Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. Thes. Logsource: windows / process_creation. Rule: title: Msxsl.EXE Execution id: 9e50a8b3-dd05-4eb8-9153-bdb6b79d50b0 status: test description: 'Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files. Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: medium