Detecting Tampering of Windows Defender Command Prompt
Hypothesis and description
In an attempt to avoid detection after compromising a machine, threat actors often try to disable Windows Defender. This is often done using “sc” [service control], a legitimate tool provided by Microsoft for managing services. This action interferes with event detection and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2020-12-11
- Contributors
- Cyware Labs
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1562 Impair DefensesT1562.001 | Stealth (formerly Defense Evasion) | Medium |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
This query looks for the specific use of service control for querying or trying to stop Windows Defender.
processes = search Process:Create
target_processes = filter processes where (
(exe="C:\\Windows\\System32\\sc.exe") AND (command_line="sc *config*" OR command_line="sc *stop*" OR command_line="sc *query*")
)
output target_processesThis query looks for the specific use of service control for querying or trying to stop Windows Defender.
index= __your_sysmon__index__ EventCode=1 Image = "C:\\Windows\\System32\\sc.exe" | regex CommandLine="^sc\s*(config|stop|query)\sWinDefend$"Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-RKDRegistry Key Deletion1 shared
- D3-SYSVASystem Vulnerability Assessment1 shared
- D3-SDMSystem Daemon Monitoring1 shared
- D3-ACHApplication Configuration Hardening1 shared
- D3-DRADisable Remote Access1 shared
- D3-EHBEndpoint Health Beacon1 shared
- D3-LLMLogical Link Mapping1 shared
- D3-NNINetwork Node Inventory1 shared
- D3-PLMPhysical Link Mapping1 shared
- D3-SICASystem Init Config Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared