huntrule

PowerShell Base64 Encoded MpPreference Command Lines for Windows Defender Modification

Detects PowerShell Base64 command lines referencing Add-MpPreference/Set-MpPreference to modify Microsoft Defender AV settings.

FreeUnreviewedSigmahighv1
title: PowerShell Base64 Encoded MpPreference Command Lines for Windows Defender Modification
id: ba9d8cf5-1807-47fb-9602-2d9eca29a688
status: test
description: This rule flags process creation events where the PowerShell command line contains Base64-encoded text referencing Add-MpPreference or Set-MpPreference. These cmdlets are used to change Microsoft Defender AV settings, which can be leveraged for defense impairment by altering security configurations. Detection relies on process command-line telemetry, matching either plain Add/Set-MpPreference strings or specific Base64 substrings consistent with UTF-16LE encoding of those cmdlets and related parameters.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://twitter.com/AdamTheAnalyst/status/1483497517119590403
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-04
modified: 2023-01-30
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|base64offset|contains:
        - "Add-MpPreference "
        - "Set-MpPreference "
        - "add-mppreference "
        - "set-mppreference "
    - CommandLine|contains:
        - QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA
        - EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA
        - BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA
        - UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA
        - MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA
        - TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA
        - YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA
        - EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA
        - hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA
        - cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA
        - MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA
        - zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c6fb44c6-71f5-49e6-9462-1425d328aee3
    type: derived

What it detects

This rule flags process creation events where the PowerShell command line contains Base64-encoded text referencing Add-MpPreference or Set-MpPreference. These cmdlets are used to change Microsoft Defender AV settings, which can be leveraged for defense impairment by altering security configurations. Detection relies on process command-line telemetry, matching either plain Add/Set-MpPreference strings or specific Base64 substrings consistent with UTF-16LE encoding of those cmdlets and related parameters.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.