Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring

Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.

FreeUnreviewedSigmahighv1

windows-process-creation-powershell-or-sc-exe-disabling-windows-defender-behavio-a7ee1722

title: "Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring"
id: 4af6ddf4-b325-4c46-93b7-8d3df2e47b2a
status: test
description: This rule flags process executions on Windows where PowerShell is used to disable Windows Defender behavior and runtime monitoring. It also detects use of sc.exe to stop, delete, or reconfigure the WinDefend service to start in a disabled state. Disabling these protections is a common attacker step to reduce detection and persistence by weakening endpoint security monitoring. The detection relies on process creation telemetry including the executable path/name and command-line arguments.
references:
  - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
  - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml
author: ok @securonix invrep-de, oscd.community, frack113, Huntrule Team
date: 2020-10-12
modified: 2022-11-18
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_pwsh_binary:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_pwsh_cli:
    CommandLine|contains:
      - -DisableBehaviorMonitoring $true
      - -DisableRuntimeMonitoring $true
  selection_sc_binary:
    - Image|endswith: \sc.exe
    - OriginalFileName: sc.exe
  selection_sc_tamper_cmd_stop:
    CommandLine|contains|all:
      - stop
      - WinDefend
  selection_sc_tamper_cmd_delete:
    CommandLine|contains|all:
      - delete
      - WinDefend
  selection_sc_tamper_cmd_disabled:
    CommandLine|contains|all:
      - config
      - WinDefend
      - start=disabled
  condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)
falsepositives:
  - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.
level: high
license: DRL-1.1
related:
  - id: a7ee1722-c3c5-aeff-3212-c777e4733217
    type: derived

What it detects

This rule flags process executions on Windows where PowerShell is used to disable Windows Defender behavior and runtime monitoring. It also detects use of sc.exe to stop, delete, or reconfigure the WinDefend service to start in a disabled state. Disabling these protections is a common attacker step to reduce detection and persistence by weakening endpoint security monitoring. The detection relies on process creation telemetry including the executable path/name and command-line arguments.

Known false positives

Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.