SEKOIA.IO Rules high stable sigma

Windows Defender Disabled

The rule detects attempts to deactivate/disable Windows Defender through command line or registry. To fully use this rule Windows Registry logging is needed. This can be done for instance using Sysmon with Event IDs 12,13 and 14 (and adding the correct path in its configuration).

View Source

Detection Logic

command_line1:
  process.command_line
| contains
| all:
    - stop
    - windefend
command_line2:
  process.command_line
| contains
| all:
    - windefend
    - disabled
command_line3:
  process.command_line
| contains
| all:
    - windows defender
    - policies
command_line4:
  process.command_line
| contains
| all:
    - windefend
    - services
command_line5:
  process.command_line
| contains:
    - disablebehaviormonitoring
    - disablerealtimemonitoring
    - add-mppreference
    - disableintrusionpreventionsystem
    - disableioavprotection
    - disablescriptscanning
    - enablecontrolledfolderaccess
    - enablenetworkprotection
    - mapsreporting
    - submitsamplesconsent
registry:
  registry.key
| contains
| all:
    - Windows Defender
    - Policies
  registry.hive: HKLM
condition: (1 of command_line*) or registry

Field Validations

Loading…

Comments (0)

Loading comments...