PotentialMicrosoftDefenderTampering[Solarigate]

id: 3f16e2c2-c0ba-4286-be9a-f22d001d2de7
name: PotentialMicrosoftDefenderTampering[Solarigate]
description: |
  Identifies potential service tampering related to Microsoft Defender services.
  Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/MultipleDataSources/PotentialMicrosoftDefenderTampering.yaml
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense evasion
query: |
  let includeProc = dynamic(["sc.exe","net1.exe","net.exe", "taskkill.exe", "cmd.exe", "powershell.exe"]);
  let action = dynamic(["stop","disable", "delete"]);
  let service1 = dynamic(['sense', 'windefend', 'mssecflt']);
  let service2 = dynamic(['sense', 'windefend', 'mssecflt', 'healthservice']);
  let params1 = dynamic(["-DisableRealtimeMonitoring", "-DisableBehaviorMonitoring" ,"-DisableIOAVProtection"]);
  let params2 = dynamic(["sgrmbroker.exe", "mssense.exe"]);
  let regparams1 = dynamic(['reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender"', 'reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection"']);
  let regparams2 = dynamic(['ForceDefenderPassiveMode', 'DisableAntiSpyware']);
  let regparams3 = dynamic(['sense', 'windefend']);
  let regparams4 = dynamic(['demand', 'disabled']);
  let timeframe = 1d;
   DeviceProcessEvents
    | where Timestamp >= ago(timeframe)
    | where InitiatingProcessFileName in~ (includeProc)
    | where (InitiatingProcessCommandLine has_any(action) and InitiatingProcessCommandLine has_any (service2) and InitiatingProcessParentFileName != 'cscript.exe')
    or (InitiatingProcessCommandLine has_any (params1) and InitiatingProcessCommandLine has 'Set-MpPreference' and InitiatingProcessCommandLine has '$true') 
    or (InitiatingProcessCommandLine has_any (params2) and InitiatingProcessCommandLine has "/IM") 
    or (InitiatingProcessCommandLine has_any (regparams1) and InitiatingProcessCommandLine has_any (regparams2) and InitiatingProcessCommandLine has '/d 1') 
    or (InitiatingProcessCommandLine has_any("start") and InitiatingProcessCommandLine has "config" and InitiatingProcessCommandLine has_any (regparams3) and InitiatingProcessCommandLine has_any (regparams4))
    | extend Account = iff(isnotempty(InitiatingProcessAccountUpn), InitiatingProcessAccountUpn, InitiatingProcessAccountName), Computer = DeviceName
    | project Timestamp, Computer, Account, AccountDomain, ProcessName = InitiatingProcessFileName, ProcessNameFullPath = FolderPath, Activity = ActionType, CommandLine = InitiatingProcessCommandLine, InitiatingProcessParentFileName