From c8284a3bb86cd09ad3cf16acfc8a8629b340998f Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 5 Jul 2021 15:49:41 +0200
Subject: [PATCH] pwh disable

---
 ...powershell_disable_security_monitoring.yml | 50 +++++++++++++++++++
 ...shell_disable_security_monitoring.test.yml | 12 +++++
 2 files changed, 62 insertions(+)
 create mode 100644 detections/endpoint/powershell_disable_security_monitoring.yml
 create mode 100644 tests/endpoint/powershell_disable_security_monitoring.test.yml

diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
new file mode 100644
index 0000000000..a144056107
--- /dev/null
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -0,0 +1,50 @@
+name: Powershell Disable Security Monitoring
+id: c148a894-dd93-11eb-bf2a-acde48001122
+version: 1
+date: '2021-07-05'
+author: Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies a modification in registry to disable the
+  windows denfender real time behavior monitoring. This event or technique is commonly
+  seen in RAT, bot, or Trojan to disable AV to evade detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("powershell.exe", "pwsh.exe", "sqlps.exe", "sqltoolsps.exe")
+  Processes.process="*set-mppreference*" AND 
+  Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `powershell_disable_security_monitoring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives. However, tune based on scripts that may perform this action.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
+tags:
+  analytic_story:
+  - Ransomware
+  - Revil
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+
+  
\ No newline at end of file
diff --git a/tests/endpoint/powershell_disable_security_monitoring.test.yml b/tests/endpoint/powershell_disable_security_monitoring.test.yml
new file mode 100644
index 0000000000..4e58c6d178
--- /dev/null
+++ b/tests/endpoint/powershell_disable_security_monitoring.test.yml
@@ -0,0 +1,12 @@
+name: Powershell Disable Security Monitoring Unit Test
+tests:
+- name: Powershell Disable Security Monitoring
+  file: endpoint/powershell_disable_security_monitoring.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file