Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)
Alerts on execution of DefenderCheck.exe/description to identify potential AV signature probing and evasion preparation.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-30
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of DefenderCheck.exe or processes with a description indicating DefenderCheck. DefenderCheck is used to evaluate Microsoft Defender signatures, which can help an attacker determine detection strings or byte patterns for evasion. The detection relies on Windows process creation telemetry and matches the executable name and process description fields.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: DefenderCheck.exe Execution (PUA/Signature Evasion)"
id: 781f921f-b96a-492d-b86b-1b5444774517
status: test
description: This rule flags execution of DefenderCheck.exe or processes with a description indicating DefenderCheck. DefenderCheck is used to evaluate Microsoft Defender signatures, which can help an attacker determine detection strings or byte patterns for evasion. The detection relies on Windows process creation telemetry and matches the executable name and process description fields.
references:
- https://github.com/matterpreter/DefenderCheck
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_defendercheck.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-30
modified: 2023-02-04
tags:
- attack.stealth
- attack.t1027.005
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \DefenderCheck.exe
- Description: DefenderCheck
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7
type: derived