Query: Sigma rule for Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
Matching passage: Sigma rule: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV. Logsource: windows / process_creation. Rule: title: Powershell Base64 Encoded MpPreference Cmdlet id: c6fb44c6-71f5-49e6-9462-1425d328aee3 status: test description: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' - 'add-mppreference ' - 'set-mppreference ' - CommandLine|contains: - QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA - cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - GoToAssist Execution id: b6d98a4f-cef0-4abf-bbf6-24132854a83d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows author: frack113 date: 2022-02-13 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: GoTo Opener - Product: GoTo Opener - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium