Manipulation of Windows Defender configuration

BIOC Informational

Manipulation of Windows Defender configuration

Commands used to bypass, disable or harm Windows Defender.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Tampering
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)

Indicator:

Process action type = execution AND target process name = net.exe , powershell.exe , reg.exe , cmd.exe AND target process cmd = *windefend* , *DisableRealtimeMonitoring* , *stop*Windows Defender*

Preventable: yes