Tamper Windows Defender Remove-MpPreference

 1title: Tamper Windows Defender Remove-MpPreference
 2id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
 3related:
 4    - id: ae2bdd58-0681-48ac-be7f-58ab4e593458
 5      type: similar
 6status: test
 7description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
 8references:
 9    - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022-08-05
12tags:
13    - attack.defense-evasion
14    - attack.t1562.001
15logsource:
16    product: windows
17    category: process_creation
18detection:
19    selection_remove:
20        CommandLine|contains: 'Remove-MpPreference'
21    selection_tamper:
22        CommandLine|contains:
23            - '-ControlledFolderAccessProtectedFolders '
24            - '-AttackSurfaceReductionRules_Ids '
25            - '-AttackSurfaceReductionRules_Actions '
26            - '-CheckForSignaturesBeforeRunningScan '
27    condition: all of selection_*
28falsepositives:
29    - Legitimate PowerShell scripts
30level: high