PotentialMicrosoftDefenderTampering[Solarigate]

Hunt Hypothesis

Adversaries may be tampering with Microsoft Defender services to disable or bypass endpoint protection, potentially allowing persistent malware execution. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced threats that evade traditional detection mechanisms.

KQL Query

let includeProc = dynamic(["sc.exe","net1.exe","net.exe", "taskkill.exe", "cmd.exe", "powershell.exe"]);
let action = dynamic(["stop","disable", "delete"]);
let service1 = dynamic(['sense', 'windefend', 'mssecflt']);
let service2 = dynamic(['sense', 'windefend', 'mssecflt', 'healthservice']);
let params1 = dynamic(["-DisableRealtimeMonitoring", "-DisableBehaviorMonitoring" ,"-DisableIOAVProtection"]);
let params2 = dynamic(["sgrmbroker.exe", "mssense.exe"]);
let regparams1 = dynamic(['reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender"', 'reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection"']);
let regparams2 = dynamic(['ForceDefenderPassiveMode', 'DisableAntiSpyware']);
let regparams3 = dynamic(['sense', 'windefend']);
let regparams4 = dynamic(['demand', 'disabled']);
let timeframe = 1d;
 DeviceProcessEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName in~ (includeProc)
  | where (InitiatingProcessCommandLine has_any(action) and InitiatingProcessCommandLine has_any (service2) and InitiatingProcessParentFileName != 'cscript.exe')
  or (InitiatingProcessCommandLine has_any (params1) and InitiatingProcessCommandLine has 'Set-MpPreference' and InitiatingProcessCommandLine has '$true') 
  or (InitiatingProcessCommandLine has_any (params2) and InitiatingProcessCommandLine has "/IM") 
  or (InitiatingProcessCommandLine has_any (regparams1) and InitiatingProcessCommandLine has_any (regparams2) and InitiatingProcessCommandLine has '/d 1') 
  or (InitiatingProcessCommandLine has_any("start") and InitiatingProcessCommandLine has "config" and InitiatingProcessCommandLine has_any (regparams3) and InitiatingProcessCommandLine has_any (regparams4))
  | extend Account = iff(isnotempty(InitiatingProcessAccountUpn), InitiatingProcessAccountUpn, InitiatingProcessAccountName), Computer = DeviceName
  | project Timestamp, Computer, Account, AccountDomain, ProcessName = InitiatingProcessFileName, ProcessNameFullPath = FolderPath, Activity = ActionType, CommandLine = InitiatingProcessCommandLine, InitiatingProcessParentFileName

Analytic Rule Definition

id: 3f16e2c2-c0ba-4286-be9a-f22d001d2de7
name: PotentialMicrosoftDefenderTampering[Solarigate]
description: |
  Identifies potential service tampering related to Microsoft Defender services.
  Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/MultipleDataSources/PotentialMicrosoftDefenderTampering.yaml
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Defense evasion
query: |
  let includeProc = dynamic(["sc.exe","net1.exe","net.exe", "taskkill.exe", "cmd.exe", "powershell.exe"]);
  let action = dynamic(["stop","disable", "delete"]);
  let service1 = dynamic(['sense', 'windefend', 'mssecflt']);
  let service2 = dynamic(['sense', 'windefend', 'mssecflt', 'healthservice']);
  let params1 = dynamic(["-DisableRealtimeMonitoring", "-DisableBehaviorMonitoring" ,"-DisableIOAVProtection"]);
  let params2 = dynamic(["sgrmbroker.exe", "mssense.exe"]);
  let regparams1 = dynamic(['reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender"', 'reg add "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection"']);
  let regparams2 = dynamic(['ForceDefenderPassiveMode', 'DisableAntiSpyware']);
  let regparams3 = dynamic(['sense', 'windefend']);
  let regparams4 = dynamic(['demand', 'disabled']);
  let timeframe = 1d;
   DeviceProcessEvents
    | where Timestamp >= ago(timeframe)
    | where InitiatingProcessFileName in~ (includeProc)
    | where (InitiatingProcessCommandLine has_any(action) and InitiatingProcessCommandLine has_any (service2) and InitiatingProcessParentFileName != 'cscript.exe')
    or (InitiatingProcessCommandLine has_any (params1) and InitiatingProcessCommandLine has 'Set-MpPreference' and InitiatingProcessCommandLine has '$true') 
    or (InitiatingProcessCommandLine has_any (params2) and InitiatingProcessCommandLine has "/IM") 
    or (InitiatingProcessCommandLine has_any (regparams1) and InitiatingProcessCommandLine has_any (regparams2) and InitiatingProcessCommandLine has '/d 1') 
    or (InitiatingProcessCommandLine has_any("start") and InitiatingProcessCommandLine has "config" and InitiatingProcessCommandLine has_any (regparams3) and InitiatingProcessCommandLine has_any (regparams4))
    | extend Account = iff(isnotempty(InitiatingProcessAccountUpn), InitiatingProcessAccountUpn, InitiatingProcessAccountName), Computer = DeviceName
    | project Timestamp, Computer, Account, AccountDomain, ProcessName = InitiatingProcessFileName, ProcessNameFullPath = FolderPath, Activity = ActionType, CommandLine = InitiatingProcessCommandLine, InitiatingProcessParentFileName

Required Data Sources

Sentinel Table	Notes
`DeviceProcessEvents`	Ensure this data connector is enabled

MITRE ATT&CK Context

Tactic: Defense evasion

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].yaml)

False Positive Guidance

Scenario: Microsoft Defender Service Restart via Task Scheduler
Description: A legitimate system administrator may restart the Microsoft Defender service using Task Scheduler to apply updates or perform maintenance.
Filter/Exclusion: process.parent_process_name != "schtasks.exe" or process.name != "services.exe"
Scenario: Microsoft Defender Configuration via Group Policy
Description: IT administrators may modify Microsoft Defender settings through Group Policy Management Console (GPMC) or using gpupdate /force.
Filter/Exclusion: process.name != "mmc.exe" or process.name != "gpupdate.exe"
Scenario: Microsoft Defender Scan Triggered by Antivirus Scheduler
Description: A scheduled scan initiated by Microsoft Defender itself (e.g., via MsMpEng.exe) can trigger the rule if the scan is misinterpreted as tampering.
Filter/Exclusion: process.name != "MsMpEng.exe" or process.parent_process_name != "MsMpEng.exe"
Scenario: Microsoft Defender Service Update via Windows Update
Description: Windows Update may restart or reconfigure Microsoft Defender services during system updates, which can be flagged as tampering.
Filter/Exclusion: process.name != "wuauclt.exe" or process.name != "svchost.exe"
Scenario: Microsoft Defender Service Restart via PowerShell Script
Description: A script (e.g., Restart-Service) may be used to restart the Microsoft Defender service as part of routine maintenance or troubleshooting.
Filter/Exclusion: process.name != "powershell.exe" or process.command_line != "Restart-Service"