Query: write Sigma for Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set defau
Matching passage: Sigma rule: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set defau. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender - ScriptBlockLogging id: 14c71865-6cd3-44ae-adaa-1db923fae5f2 related: - id: ec19ebab-72dc-40e1-9728-4c0b805d722c type: derived status: test description: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-16 modified: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_options_disabling_preference: ScriptBlockText|contains: Set-MpPreference selection_options_disabling_function: ScriptBlockText|contains: - -dbaf $true - -dbaf 1 - -dbm $true - -dbm 1 - -dips $true - -dips 1 - -DisableArchiveScanning $true - -DisableArchiveScanning 1 - -DisableBehaviorMonitoring $true - -DisableBehaviorMonitoring 1 - -DisableBlockAtFirstSeen $true - -DisableBlockAtFirstSeen 1 - -DisableCatchupFullScan $true - -DisableCatchupFullScan 1 - -DisableCatchupQuickScan $true - -DisableCatchupQuickScan 1 - -DisableIntrusionPreventionSystem $true - -DisableIntrusionPreventionSystem 1 - -DisableIOAVProtection $true - -DisableIOAVProtection 1 - -DisableRealtimeMonitoring $true - -DisableRealtimeMonitoring 1 - -DisableRemovableDriveScanning $true - -DisableRemovableDriveScanning 1 - -DisableScanningMappedNetworkDrivesForFullScan $true - -DisableScanningMappedNetworkDrivesForFullScan 1 - -DisableScanningNetworkFiles $true - -DisableScanningNetworkFiles 1 - -DisableScriptScanning $true - -DisableScriptScanning 1 - -MAPSReporting $false - -MAPSReporting 0 - -drdsc $true - -drdsc 1 - -drtm $true - -drtm 1 - -dscrptsc $true - -dscrptsc 1 - -dsmndf $true - -dsmndf 1 - -dsnf $true - -dsnf 1 - -dss $true - -dss 1 selection_other_default_actions_allow: ScriptBlockText|contains: Set-MpPreference selection_other_default_actions_func: ScriptBlockText|contains: - HighThreatDefaultAction Allow - htdefac Allow - LowThreatDefaultAction Allow - ltdefac Allow - ModerateThreatDefaultAction Allow -
Near-miss passage: Sigma rule: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit. Logsource: windows / msexchange-management. Rule: title: Remove Exported Mailbox from Exchange Webserver id: 09570ae5-889e-43ea-aac0-0e1221fb3d95 status: test description: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430 author: Christian Burkard (Nextron Systems) date: 2021-08-27 modified: 2023-01-23 tags: - attack.stealth - attack.t1070 logsource: service: msexchange-management product: windows detection: keywords: '|all': - Remove-MailboxExportRequest - ' -Identity ' - ' -Confirm "False"' condition: keywords falsepositives: - Unknown level: high