Powershell Base64 Encoded MpPreference Cmdlet

Hunt Hypothesis

Detects base64 encoded “MpPreference” PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Detection Rule

Sigma (Original)

title: Powershell Base64 Encoded MpPreference Cmdlet
id: c6fb44c6-71f5-49e6-9462-1425d328aee3
status: test
description: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
references:
    - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
    - https://twitter.com/AdamTheAnalyst/status/1483497517119590403
author: Florian Roth (Nextron Systems)
date: 2022-03-04
modified: 2023-01-30
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|base64offset|contains:
              - 'Add-MpPreference '
              - 'Set-MpPreference '
              - 'add-mppreference '
              - 'set-mppreference '
        - CommandLine|contains:
              # UTF16-LE
              - 'QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
              - 'EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
              - 'BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
              - 'UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA'
              - 'MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA'
              - 'TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA'
              - 'YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
              - 'EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
              - 'hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
              - 'cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA'
              - 'MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA'
              - 'zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine contains "QWRkLU1wUHJlZmVyZW5jZS" or TargetProcessCommandLine contains "FkZC1NcFByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "BZGQtTXBQcmVmZXJlbmNlI" or TargetProcessCommandLine contains "U2V0LU1wUHJlZmVyZW5jZS" or TargetProcessCommandLine contains "NldC1NcFByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "TZXQtTXBQcmVmZXJlbmNlI" or TargetProcessCommandLine contains "YWRkLW1wcHJlZmVyZW5jZS" or TargetProcessCommandLine contains "FkZC1tcHByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "hZGQtbXBwcmVmZXJlbmNlI" or TargetProcessCommandLine contains "c2V0LW1wcHJlZmVyZW5jZS" or TargetProcessCommandLine contains "NldC1tcHByZWZlcmVuY2Ug" or TargetProcessCommandLine contains "zZXQtbXBwcmVmZXJlbmNlI") or (TargetProcessCommandLine contains "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA" or TargetProcessCommandLine contains "cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA" or TargetProcessCommandLine contains "MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA" or TargetProcessCommandLine contains "zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA")

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Technique: T1685 — T1685

References

• https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
• https://twitter.com/AdamTheAnalyst/status/1483497517119590403
• SigmaHQ Rule