Tamper Windows Defender - ScriptBlockLogging

About the rule

Rule Type

Standard

Rule Description

Tamper Windows Defender - ScriptBlockLogging is an instance where an executable process attempts to disable scheduled scanning and other functions of Windows Defender ATP and exploit by attackers by setting default actions to allow malicious resources.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access (through phishing) → Execution → Defense Evasion → Command and Control → Impact

Impact

• Attacker executes a PowerShell payload, either directly or through loader tools.
• Attacker runs -DisableScriptBlockLogging $true or Remove-MpPreference -DisableScriptBlockLogging to disable PowerShell ScriptBlockLogging.
• ScriptBlockLogging hides PowerShell-based malicious actions and malware attack traces.

Rule Requirement

Prerequisites

• Log in to the Group Policy Management Console (GPMC) with domain admin credentials.
• In the Group Policy Management Editor, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Powershell and enable Turn on Module Logging.
• In the Options pane, click on Show, and in the Module Name, enter * to record all modules, and press OK.
• In the Group Policy Management Editor, go to Computer Configuration and Turn on PowerShell Script Block Logging.
• Create a new registry key "Microsoft-Windows-Powershell/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Defense Evasion: Impair Defenses - Disable or Modify Tools (T1562.001)

Security Standards

Enabling this rule will help you meet the security standard's requirement listed below:

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.

DE.CM-01: Networks and network services are monitored to find potentially adverse events.

Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual behavior during the Window Defender process attempts to disable scheduled scanning and other functions of Windows Defender ATP. Enforce the policies on the web traffic to ensure the network security.

Author

frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)

Future actions

Known False Positives

In a few instances, Tamper Windows Defender – ScriptBlockLogging process could be a legitimate administrator activity or an authorized troubleshooting effort pertaining to IT maintenance or testing procedures.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify the event and check if the flagged incident is new or part of an existing one.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
4. Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.

Mitigation