Windows Defender script scanning was disabled by Powershell command

Description

Windows Defender script scanning was disabled by Powershell command

Query · wazuh

field win.eventdata.commandLine="(?i)(DisableScriptScanning|dscrptsc)\s+(\$true|1)"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 92007 Possible tampering on Windows Defender configuration by Powershell command anchor level 3
    field win.eventdata.image="(?i)\\powershell\.exe" AND field win.eventdata.commandLine="(?i)Set-MpPreference"
  2. 92011 Windows Defender script scanning was disabled by Powershell command refinement level 13 this rule
    field win.eventdata.commandLine="(?i)(DisableScriptScanning|dscrptsc)\s+(\$true|1)"

Rule dependencies

Depends on

Raw source Windows Defender script scanning was disabled by Powershell command · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="92011" level="13">
    <if_sid>92007</if_sid>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)(DisableScriptScanning|dscrptsc)\s+(\$true|1)</field>
    <options>no_full_log</options>
    <description>Windows Defender script scanning was disabled by Powershell command</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.