Windows Defender Disabled Detection (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

An attacker could disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software, real-time monitoring or Windows Defender Service

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

References

https://github.com/swagkarna/Defeat-Defender

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

id: '1044.1071'
title: Windows Defender Disabled Detection
description: 'An attacker could disable security tools to avoid possible detection
  of their tools and activities. This can take the form of killing security software,
  real-time monitoring or Windows Defender Service. -- Threat Actor Association: FIN6,
  FIN11, Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm),
  Vice Society, Wizard Spider -- Software Association: Bazarloader, BianLian, Blackbyte,
  Black Basta, Clop, Conti, DirtyMoe, Lockbit, Sodinokibi/REvil, Vice Society, WhisperGates
  -- #TrendingThreat #Russia #Ukraine - Atomics T1588.002 Test #1'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` EventCode=13 AND (("WdNisDrv")
  OR ("FirewallPolicy" AND "0x00000000")) | table _time, host, user dest, direction,
  dvc, dvc_nt_host, event_id, eventtype, hashes, host, index, parent_process_id, process,
  process_id, process_name, process_path, signature_id, source, sourcetype, tag, user_id
  | bin span=60s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1562.001
data_category:
- Windows Sysmon
references:
- https://github.com/swagkarna/Defeat-Defender

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=13 AND (("WdNisDrv") OR ("FirewallPolicy" AND "0x00000000"))

Stage 2: `table`

| table _time, host, user dest, direction, dvc, dvc_nt_host, event_id, eventtype, hashes, host, index, parent_process_id, process, process_id, process_name, process_path, signature_id, source, sourcetype, tag, user_id

Stage 3: `bucket`

| bin span=60s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`13` corpus 23 (splunk 18, kusto 5)	`field:"EventID" kind:eq value:"13"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"WdNisDrv"`
1	`"FirewallPolicy"`
1	`"0x00000000"`