Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging

 1title: Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
 2id: ae2bdd58-0681-48ac-be7f-58ab4e593458
 3related:
 4    - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
 5      type: similar
 6status: test
 7description: Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet
 8references:
 9    - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022-08-05
12tags:
13    - attack.defense-evasion
14    - attack.t1562.001
15logsource:
16    product: windows
17    category: ps_script
18    definition: 'Requirements: Script Block Logging must be enabled'
19detection:
20    selection_remove:
21        ScriptBlockText|contains: 'Remove-MpPreference'
22    selection_tamper:
23        ScriptBlockText|contains:
24            - '-ControlledFolderAccessProtectedFolders '
25            - '-AttackSurfaceReductionRules_Ids '
26            - '-AttackSurfaceReductionRules_Actions '
27            - '-CheckForSignaturesBeforeRunningScan '
28    condition: all of selection_*
29falsepositives:
30    - Legitimate PowerShell scripts
31level: high