Detection rules › Sigma
Microsoft Defender service deactivation attempt (command)
Detects scenarios where an attacker attempts to disable Defender security service. If tamper protection is enabled, this action may not work.
Known false positives
- None
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Microsoft Defender service deactivation attempt (command)
description: Detects scenarios where an attacker attempts to disable Defender security service. If tamper protection is enabled, this action may not work.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://github.com/swagkarna/Defeat-Defender-V1.2
- https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-on-windows-server?view=o365-worldwide
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
NewProcessName|endswith: '\sc.exe'
CommandLine|contains|all:
- sc
- config
- disabled
CommandLine|contains: # Defender related services names
- WinDefend
- Sense
- MpsSvc
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith: '\sc.exe'
CommandLine|contains|all:
- sc
- config
- disabled
CommandLine|contains:
- WinDefend
- Sense
- MpsSvc
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\sc.exe" |