Windows Defender blocked MpCmdRun and NisSrv from loading unsigned DLLs

title: Windows Defender blocked MpCmdRun and NisSrv from loading unsigned DLLs
id: f2b0ba8e-a7f6-4b5f-b3b5-484f4d7a233a
status: test
description: This rule identifies Windows security-mitigations events where Microsoft Defender components (MpCmdRun and NisSrv) are blocked from loading unsigned DLLs. Attackers may attempt DLL sideloading to execute malicious code within a trusted Defender process, so blocking unsigned DLL loads is a key defensive signal. The detection relies on security-mitigations telemetry events (EventID 11 and 12) that report unsigned DLL blocking for specific Defender process paths.
references:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-08-02
modified: 2022-09-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  service: security-mitigations
detection:
  selection:
    EventID:
      - 11
      - 12
    ProcessPath|endswith:
      - \MpCmdRun.exe
      - \NisSrv.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86
    type: derived