SEKOIA.IO Rules high stable sigma

Microsoft Defender Antivirus Set-MpPreference Base64 Encoded

Detects changes of preferences for Microsoft Defender Antivirus (MDAV) scan and updates. Configuring MDAV with base64-encoded commands is suspicious and could be related to malicious activities.

View Source

Detection Logic

selection1:
  process.command_line
| wide
| base64offset
| contains:
    - Set-MpPreference
    - set-mppreference
    - Add-MpPreference
    - add-mppreference
selection2:
  action.properties.ScriptBlockText
| wide
| base64offset
| contains:
    - Set-MpPreference
    - set-mppreference
    - Add-MpPreference
    - add-mppreference
condition: selection1 or selection2

Field Validations

Loading…

Comments (0)

Loading comments...