Windows PowerShell ScriptBlock Logging: Remove-MpPreference tampering for Defender settings

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

FreeUnreviewedSigmahighv1

windows-powershell-scriptblock-logging-remove-mppreference-tampering-for-defende-ae2bdd58

title: "Windows PowerShell ScriptBlock Logging: Remove-MpPreference tampering for Defender settings"
id: 26173361-29ea-4535-b4db-5493bc8aeada
related:
  - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
    type: similar
  - id: ae2bdd58-0681-48ac-be7f-58ab4e593458
    type: derived
status: test
description: This rule flags PowerShell script content that attempts to modify or remove Windows Defender configuration by invoking the Remove-MpPreference cmdlet. It matters because attackers can impair endpoint defenses by changing Defender settings, including controls tied to protected folders and attack surface reduction rules. The detection relies on ScriptBlockText matches captured via Script Block Logging, looking for Remove-MpPreference alongside indicators of related Defender configuration parameters.
references:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_remove:
    ScriptBlockText|contains: Remove-MpPreference
  selection_tamper:
    ScriptBlockText|contains:
      - "-ControlledFolderAccessProtectedFolders "
      - "-AttackSurfaceReductionRules_Ids "
      - "-AttackSurfaceReductionRules_Actions "
      - "-CheckForSignaturesBeforeRunningScan "
  condition: all of selection_*
falsepositives:
  - Legitimate PowerShell scripts
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell script content that attempts to modify or remove Windows Defender configuration by invoking the Remove-MpPreference cmdlet. It matters because attackers can impair endpoint defenses by changing Defender settings, including controls tied to protected folders and attack surface reduction rules. The detection relies on ScriptBlockText matches captured via Script Block Logging, looking for Remove-MpPreference alongside indicators of related Defender configuration parameters.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.