Windows Defender Exclusions via WMI

[rule]
description = """
Identifies attempt to modify to the Windows Defender configuration settings to add an exclusion via the Windows
Management Instrumentation method.
"""
id = "73310ee3-5e48-4680-b7c5-c096813c7f03"
license = "Elastic License v2"
name = "Windows Defender Exclusions via WMI"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps",
]
version = "1.0.8"

query = '''
api where
  process.Ext.api.name == "IWbemServices::ExecMethod" and
  process.Ext.api.parameters.operation : "*MSFT_MpPreference::Add*" and

  not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\Sys?????\\WindowsPowerShell\\v*\\powershell.exe") and
  not (process.executable == "C:\\Windows\\System32\\svchost.exe" and process.parent.executable == "C:\\Windows\\System32\\services.exe") and
  not process.parent.executable : (
          "?:\\Program Files\\JetBrains\\*\\lib\\ReSharperHost\\JetBrains.Rider.AfterInstall.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\*\\lib\\ReSharperHost\\JetBrains.Rider.AfterInstall.exe", 
          "?:\\Program Files\\JetBrains\\*\\bin\\elevator.exe",
          "?:\\Users\\*\\AppData\\Local\\Programs\\*\\bin\\elevator.exe", 
          "?:\\Users\\*\\AppData\\Local\\Temp\\dbeaver-ce-*", 
          "?:\\Users\\*\\AppData\\Local\\Temp\\*\\dbeaver-ce-*", 
          "?:\\Users\\*\\Downloads\\dbeaver-ce-*", 
          "?:\\Users\\*\\Downloads\\dbeaver-ee-*", 
          "?:\\ProgramData\\chocolatey\\lib\\dbeaver\\tools\\dbeaver-ce-*", 
          "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\DCHUService.exe"
        ) and
  not (process.code_signature.subject_name in ("Censornet Limited") and process.code_signature.trusted == true) and
  not (process.parent.executable : "C:\\Windows\\SysWOW64\\cmd.exe" and process.name : "powershell.exe" and
       process.command_line : "powerShell  Add-MpPreference -ControlledFolderAccessAllowedApplications*") and
  not (process.name : "wmic.exe" and
       process.command_line : ("WMIC  /NAMESPACE:\\\\root\\Microsoft\\Windows\\Defender PATH MSFT_MpPreference call Add ExclusionPath=\"c:\\windows\\puppet\\activate\\*",
                               "WMIC  /NAMESPACE:\\\\root\\Microsoft\\Windows\\Defender PATH MSFT_MpPreference call Add ExclusionPath=\"C:\\Windows\\AAct_Tools\\*")) and
  not process.command_line : "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess \"UltraSearch.exe\" " and
  not (process.name : "powershell.exe" and
       process.command_line : ("*JABlAHgAYwBsAHUAcwBpAG8AbgBzAD0AQAAoACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEQAQgBlAGEAdgBlAHIAXABkAGIAZQBhAHYAZQByAC4AZQB4AGUAI*",
                               "*AkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwA*",
                               "*WwBDAG8AbABsAGUAYwB0AGkAbwBuAHMALgBHAGUAbgBlAHIAaQBjAC4ASABhAHMAaABTAGUAdABbAFMAdAByAGkAbgBnAF0AXQAoAEcAZQB0AC0A*")) and
  not (process.parent.executable : "C:\\Windows\\System32\\cmd.exe" and process.command_line : "*\\EC2Launch*\\UserScript.ps1*")
'''

min_endpoint_version = "8.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.15.0"