Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring
Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.
- Product
- windows
- Category
- process_creation
- Author
- ok @securonix invrep-de, oscd.community, frack113 (SigmaHQ), DRL 1.1
- Published
- 2020-10-12
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions on Windows where PowerShell is used to disable Windows Defender behavior and runtime monitoring. It also detects use of sc.exe to stop, delete, or reconfigure the WinDefend service to start in a disabled state. Disabling these protections is a common attacker step to reduce detection and persistence by weakening endpoint security monitoring. The detection relies on process creation telemetry including the executable path/name and command-line arguments.
Reporting behind it
- research.nccgroup.comhttps://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- rvsec0n.wordpress.comhttps://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring"
id: 4af6ddf4-b325-4c46-93b7-8d3df2e47b2a
status: test
description: This rule flags process executions on Windows where PowerShell is used to disable Windows Defender behavior and runtime monitoring. It also detects use of sc.exe to stop, delete, or reconfigure the WinDefend service to start in a disabled state. Disabling these protections is a common attacker step to reduce detection and persistence by weakening endpoint security monitoring. The detection relies on process creation telemetry including the executable path/name and command-line arguments.
references:
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml
author: ok @securonix invrep-de, oscd.community, frack113, Huntrule Team
date: 2020-10-12
modified: 2022-11-18
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_pwsh_binary:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_pwsh_cli:
CommandLine|contains:
- -DisableBehaviorMonitoring $true
- -DisableRuntimeMonitoring $true
selection_sc_binary:
- Image|endswith: \sc.exe
- OriginalFileName: sc.exe
selection_sc_tamper_cmd_stop:
CommandLine|contains|all:
- stop
- WinDefend
selection_sc_tamper_cmd_delete:
CommandLine|contains|all:
- delete
- WinDefend
selection_sc_tamper_cmd_disabled:
CommandLine|contains|all:
- config
- WinDefend
- start=disabled
condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)
falsepositives:
- Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice.
level: high
license: DRL-1.1
related:
- id: a7ee1722-c3c5-aeff-3212-c777e4733217
type: derived