huntrule

Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)

Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)"
id: 781f921f-b96a-492d-b86b-1b5444774517
status: test
description: This rule flags execution of DefenderCheck.exe or processes with a description indicating DefenderCheck. DefenderCheck is used to evaluate Microsoft Defender signatures, which can help an attacker determine detection strings or byte patterns for evasion. The detection relies on Windows process creation telemetry and matches the executable name and process description fields.
references:
  - https://github.com/matterpreter/DefenderCheck
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_defendercheck.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-30
modified: 2023-02-04
tags:
  - attack.stealth
  - attack.t1027.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \DefenderCheck.exe
    - Description: DefenderCheck
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7
    type: derived

What it detects

This rule flags execution of DefenderCheck.exe or processes with a description indicating DefenderCheck. DefenderCheck is used to evaluate Microsoft Defender signatures, which can help an attacker determine detection strings or byte patterns for evasion. The detection relies on Windows process creation telemetry and matches the executable name and process description fields.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.