Detects base64 encoded “MpPreference” PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
title: Powershell Base64 Encoded MpPreference Cmdlet
id: c6fb44c6-71f5-49e6-9462-1425d328aee3
status: test
description: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
references:
- https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://twitter.com/AdamTheAnalyst/status/1483497517119590403
author: Florian Roth (Nextron Systems)
date: 2022-03-04
modified: 2023-01-30
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|base64offset|contains:
- 'Add-MpPreference '
- 'Set-MpPreference '
- 'add-mppreference '
- 'set-mppreference '
- CommandLine|contains:
# UTF16-LE
- 'QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
- 'EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
- 'BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
- 'UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
- 'MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
- 'TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
- 'YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
- 'EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
- 'hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
- 'cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
- 'MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
- 'zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
condition: selection
falsepositives:
- Unknown
level: high
imProcessCreate
| where (TargetProcessCommandLine contains "QWRkLU1wUHJlZmVyZW5jZS" or TargetProcessCommandLine contains "FkZC1NcFByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "BZGQtTXBQcmVmZXJlbmNlI" or TargetProcessCommandLine contains "U2V0LU1wUHJlZmVyZW5jZS" or TargetProcessCommandLine contains "NldC1NcFByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "TZXQtTXBQcmVmZXJlbmNlI" or TargetProcessCommandLine contains "YWRkLW1wcHJlZmVyZW5jZS" or TargetProcessCommandLine contains "FkZC1tcHByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "hZGQtbXBwcmVmZXJlbmNlI" or TargetProcessCommandLine contains "c2V0LW1wcHJlZmVyZW5jZS" or TargetProcessCommandLine contains "NldC1tcHByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "zZXQtbXBwcmVmZXJlbmNlI") or (TargetProcessCommandLine contains "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA")| Sentinel Table | Notes |
|---|---|
imProcessCreate | Ensure this data connector is enabled |