title: Suspicious Start-Process PassThru
id: 14c71865-6cd3-44ae-adaa-1db923fae5f2
related:
    - id: ec19ebab-72dc-40e1-9728-4c0b805d722c
      type: derived
status: experimental
description: Attempting to disable scheduled scanning and other parts of windows defender atp. Or set default actions to allow.
author: frack113, elhoim
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
    - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
    - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
date: 2022/01/16
modified: 2022/05/05
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_options_disabling_preference:
        ScriptBlockText|contains: 'Set-MpPreference'
    selection_options_disabling_function:
        ScriptBlockText|contains:
            - 'DisableRealtimeMonitoring 1'
            - 'DisableBehaviorMonitoring 1'
            - 'DisableScriptScanning 1'
            - 'DisableArchiveScanning 1'
            - 'DisableBlockAtFirstSeen 1'
            - 'DisableIOAVProtection 1'
            - 'DisableIntrusionPreventionSystem 1'
            - 'DisableRemovableDriveScanning 1'
            - 'DisableScanningMappedNetworkDrivesForFullScan 1'
            - 'DisableScanningNetworkFiles 1'
            - 'DisableRealtimeMonitoring $true'
            - 'DisableBehaviorMonitoring $true'
            - 'DisableScriptScanning $true'
            - 'DisableArchiveScanning $true'
            - 'DisableBlockAtFirstSeen $true'
            - 'DisableIOAVProtection $true'
            - 'DisableIntrusionPreventionSystem $true'
            - 'DisableRemovableDriveScanning $true'
            - 'DisableScanningMappedNetworkDrivesForFullScan $true'
            - 'DisableScanningNetworkFiles $true'
    selection_default_actions_allow:
        ScriptBlockText|contains|all:
            - 'Set-MpPreference'
            - Allow
        ScriptBlockText|contains:
            - LowThreatDefaultAction
            - ModerateThreatDefaultAction
            - HighThreatDefaultAction
    condition: all of selection_options_disabling* or selection_default_actions_allow
falsepositives:
    - Legitimate PowerShell scripts
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.001
