Microsoft Defender threat exclusion added (PowerShell)

Status: experimental
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: Microsoft Defender threat exclusion added (PowerShell)
description: Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
- https://cloudbrothers.info/en/current-limits-defender-av-tamper-protection/
- https://www.intrinsec.com/apt27-analysis/
- https://cybersecuritynews-com.cdn.ampproject.org/c/s/cybersecuritynews.com/u-s-federal-network-hacked/?amp
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection1_powershell_native:
    EventID: 800
    EventData|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    EventData|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  selection2_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    Payload|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    ScriptBlockText|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1_powershell_native`

selection1_powershell_native:
  EventID: 800
  EventData|contains|all:
    - Add-MpPreference
    - Set-MpPreference
  EventData|contains:
    - ExclusionPath
    - ExclusionExtension
    - ExclusionProcess
    - ExclusionIpAddress

Stage 2: `selection2_powershell_modern`

selection2_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - Add-MpPreference
    - Set-MpPreference
  Payload|contains:
    - ExclusionPath
    - ExclusionExtension
    - ExclusionProcess
    - ExclusionIpAddress

Stage 3: `selection3_powershell_block`

selection3_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - Add-MpPreference
    - Set-MpPreference
  ScriptBlockText|contains:
    - ExclusionPath
    - ExclusionExtension
    - ExclusionProcess
    - ExclusionIpAddress

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`Add-MpPreference` corpus 4 (sigma 4) `ExclusionExtension` `ExclusionIpAddress` `ExclusionPath` `ExclusionProcess` `Set-MpPreference` corpus 5 (sigma 5)	`field:"EventData" kind:match`
`Payload`	match	`Add-MpPreference` corpus 2 (sigma 2) `ExclusionExtension` `ExclusionIpAddress` `ExclusionPath` `ExclusionProcess` `Set-MpPreference` corpus 2 (sigma 2)	`field:"Payload" kind:match`
`ScriptBlockText`	match	`Add-MpPreference` corpus 2 (sigma 2) `ExclusionExtension` `ExclusionIpAddress` `ExclusionPath` `ExclusionProcess` `Set-MpPreference` corpus 3 (sigma 3)	`field:"ScriptBlockText" kind:match`

Microsoft Defender threat exclusion added (PowerShell)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1_powershell_native

Stage 2: selection2_powershell_modern

Stage 3: selection3_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection1_powershell_native`

Stage 2: `selection2_powershell_modern`

Stage 3: `selection3_powershell_block`