Microsoft Defender critical security components disabled (PowerShell)

title: Microsoft Defender critical security components disabled (PowerShell)
description: Detects scenarios where an attacker attempts to disable Defender security features in PowerShell
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://github.com/swagkarna/Defeat-Defender-V1.2
- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
- https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp
- https://powershell.one/wmi/root/microsoft/windows/defender/msft_mppreference
- https://gist.github.com/pe3zx/7c5e0080c3b0869ccba1f1dc2ea0c5e0
- https://cloudbrothers.info/en/current-limits-defender-av-tamper-protection/
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # Set-MpPreference -DisableRealtimeMonitoring $true
  selection1_powershell_native:
    EventID: 800
    EventData|contains: Set-MpPreference
    EventData|contains:
      - '1'
      - '$true'
    EventData|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  selection2_powershell_modern:
    EventID: 4103
    EventData|contains: Set-MpPreference
    Payload|contains:
      - '1'
      - '$true'
    Payload|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  selection3_powershell_block:
    EventID: 4104
    EventData|contains: Set-MpPreference
    ScriptBlockText|contains:
      - '1'
      - '$true'
    ScriptBlockText|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  condition: 1 of selection*
falsepositives:
- None
level: high