SEKOIA.IO Rules high stable sigma

Microsoft Defender Antivirus Disabled Base64 Encoded

Detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through base64 encoded PowerShell command line.

View Source

Detection Logic

selection1:
  process.command_line
| wide
| base64offset
| contains:
    - DisableBehaviorMonitoring
    - DisableRealtimeMonitoring
    - Add-MpPreference
    - DisableIntrusionPreventionSystem
    - DisableIOAVProtection
    - DisableScriptScanning
    - EnableControlledFolderAccess
    - EnableNetworkProtection
    - MAPSReporting
    - SubmitSamplesConsent
selection2:
  action.properties.ScriptBlockText
| wide
| base64offset
| contains:
    - DisableBehaviorMonitoring
    - DisableRealtimeMonitoring
    - Add-MpPreference
    - DisableIntrusionPreventionSystem
    - DisableIOAVProtection
    - DisableScriptScanning
    - EnableControlledFolderAccess
    - EnableNetworkProtection
    - MAPSReporting
    - SubmitSamplesConsent
condition: selection1 or selection2

Field Validations

Loading…

Comments (0)

Loading comments...