Windows Process Creation: Remove-MpPreference Used to Tamper Windows Defender Settings

Flags process executions that call Remove-MpPreference with Defender tampering-related parameters.

FreeUnreviewedSigmahighv1

windows-process-creation-remove-mppreference-used-to-tamper-windows-defender-set-07e3cb2c

title: "Windows Process Creation: Remove-MpPreference Used to Tamper Windows Defender Settings"
id: 36ce3062-6468-4eac-996a-01e901cd321c
related:
  - id: ae2bdd58-0681-48ac-be7f-58ab4e593458
    type: similar
  - id: 07e3cb2c-0608-410d-be4b-1511cb1a0448
    type: derived
status: test
description: This rule identifies PowerShell or scripting activity that invokes the Remove-MpPreference cmdlet and includes parameters consistent with modifying or disabling Windows Defender protections. Attackers can use this behavior to reduce endpoint security coverage and facilitate follow-on malicious activity. The detection relies on process creation telemetry, specifically CommandLine contents that include Remove-MpPreference and the relevant Defender configuration flags.
references:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: process_creation
detection:
  selection_remove:
    CommandLine|contains: Remove-MpPreference
  selection_tamper:
    CommandLine|contains:
      - "-ControlledFolderAccessProtectedFolders "
      - "-AttackSurfaceReductionRules_Ids "
      - "-AttackSurfaceReductionRules_Actions "
      - "-CheckForSignaturesBeforeRunningScan "
  condition: all of selection_*
falsepositives:
  - Legitimate PowerShell scripts
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell or scripting activity that invokes the Remove-MpPreference cmdlet and includes parameters consistent with modifying or disabling Windows Defender protections. Attackers can use this behavior to reduce endpoint security coverage and facilitate follow-on malicious activity. The detection relies on process creation telemetry, specifically CommandLine contents that include Remove-MpPreference and the relevant Defender configuration flags.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.