Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging

About the rule

Rule Type

Standard

Rule Description

Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging is an instance where an executable process attempts to remove or modify Windows Defender Configurations (Windows Antivirus) using the "MpPreference" cmdlet, and is exploited by attackers to deploy payloads and other malign materials.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access (through phishing) → Execution → Defense Evasion → Command and Control → Impact

Impact

• Attacker executes a PowerShell payload, either directly or through loader tools.
• Attacker runs either Set-MpPreference -DisableScriptBlockLogging $true or Remove-MpPreference -DisableScriptBlockLogging to disable PowerShell ScriptBlockLogging.
• Removing forensic traces of future script execution

Rule Requirement

Prerequisites

• Log in to the Group Policy Management Console (GPMC) with domain admin credentials.
• In the Group Policy Management Editor, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Powershell and enable Turn on Module Logging.
• In the Options pane, click on Show, and in the Module Name, enter * to record all modules, and press OK.
• In the Group Policy Management Editor, go to Computer Configuration and Turn on PowerShell Script Block Logging.
• Create a new registry key "Microsoft-Windows-Powershell/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Defense Evasion: Impair Defenses - Disable or Modify Tools (T1562.001)

Security Standards

Enabling this rule will help you meet the security standard's requirements listed below:

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Security administrators must ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.

DE.CM-01: Networks and network services are monitored to find potentially adverse events.

Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual process of "MpPreference" cmdlet. Enforce policies on the web traffic to ensure network security.

Author

Nasreddine Bencherchali (Nextron Systems)

Future actions

Known False Positives

In a few instances, security or other authorized tools run PowerShell scripts that include Remove-MpPreference or Set-MpPreference commands to standardize security configurations across systems. Sometimes, ScriptBlockLogging during troubleshooting, performance testing, or scripted installations are legitimate but alerts could be raised.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify the event and check if the flagged incident is new or part of an existing one.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
4. Reconfiguration: Update network policies, port configurations, and continuously monitor traffic trends in the network.

Mitigation