Detectionhightest
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Fri Aug 05ae2bdd58-0681-48ac-be7f-58ab4e593458windows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script
Definition
Requirements: Script Block Logging must be enabled
Detection Logic
Detection Logic2 selectors
detection:
selection_remove:
ScriptBlockText|contains: 'Remove-MpPreference'
selection_tamper:
ScriptBlockText|contains:
- '-ControlledFolderAccessProtectedFolders '
- '-AttackSurfaceReductionRules_Ids '
- '-AttackSurfaceReductionRules_Actions '
- '-CheckForSignaturesBeforeRunningScan '
condition: all of selection_*False Positives
Legitimate PowerShell scripts
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
ae2bdd58-0681-48ac-be7f-58ab4e593458
Status
test
Level
high
Type
Detection
Created
Fri Aug 05
Path
rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
Raw Tags
attack.defense-evasionattack.t1562.001