SEKOIA.IO Rules high stable sigma

Microsoft Defender Antivirus Disable Services

The rule detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through command line and registry.

View Source

Detection Logic

powershell_command_stop_service:
  action.properties.ScriptBlockText
| contains
| all:
    - Get-Service
    - Stop-Service
cmd_command_stop_service:
  process.command_line
| contains
| all:
    - sc
    - stop
cmd_command_disable_service:
  process.command_line
| contains
| all:
    - sc
    - config
    - start=disabled
powershell_service_name:
  action.properties.ScriptBlockText
| contains:
    - WinDefend
    - WdNisSvc
    - " Sense"
cmd_service_name:
  process.command_line
| contains:
    - WinDefend
    - WdNisSvc
    - " Sense"
powershell_modify_registry:
  action.properties.ScriptBlockText
| contains
| all:
    - Set-ItemProperty
    - CurrentControlSet
    - Services
    - Start
cmd_modify_registry:
  process.command_line
| contains
| all:
    - reg
    - add
    - currentcontrolset
    - service
    - start
condition: (powershell_command_stop_service and powershell_service_name) or
  (cmd_command_stop_service and cmd_service_name) or
  (cmd_command_disable_service and cmd_service_name) or
  (powershell_modify_registry and powershell_service_name) or
  (cmd_modify_registry and cmd_service_name)

Field Validations

Loading…

Comments (0)

Loading comments...