Powershell Windows Defender Exclusion Commands

Try in Splunk Security Cloud

Description

The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. It leverages EventCode 4104 to identify suspicious Add-MpPreference or Set-MpPreference commands with exclusion parameters. This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2024-05-26
• Author: Teoderick Contreras, Splunk
• ID: 907ac95c-4dd9-11ec-ba2c-acde48001122

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1562.001	Disable or Modify Tools	Defense Evasion

T1562

Impair Defenses

Defense Evasion

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`powershell` EventCode=4104 (ScriptBlockText = "*Add-MpPreference *" OR ScriptBlockText = "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
| rename Computer as dest 
| rename UserID as user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `powershell_windows_defender_exclusion_commands_filter`

Macros

The SPL above uses the following Macros:

• powershell
• security_content_ctime

powershell_windows_defender_exclusion_commands_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• EventCode
• ScriptBlockText
• Computer
• UserID

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Registry node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.

Known False Positives

admin or user may choose to use this windows features.

Associated Analytic Story

• CISA AA22-320A
• AgentTesla
• Remcos
• Windows Defense Evasion Tactics
• Data Destruction
• WhisperGate
• Warzone RAT

RBA

Risk Score	Impact	Confidence	Message
64.0	80	80	exclusion command $ScriptBlockText$ executed on $Computer$

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
• https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 3