huntrule

Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)

Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-30
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of DefenderCheck.exe or processes with a description indicating DefenderCheck. DefenderCheck is used to evaluate Microsoft Defender signatures, which can help an attacker determine detection strings or byte patterns for evasion. The detection relies on Windows process creation telemetry and matches the executable name and process description fields.

Reporting behind it

Related detections3 linkedT1027.005 — drag to rearrange
Windows: Detect rcedit editing PE version/resource metadata via --set-*
Windows: CrackMapExec PowerShell obfuscation via join/split static patterns
Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions
Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)
Pivot detection · T1027.005 · 3 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.