name: Disable Defender MpEngine Registry
id: cc391750-3024-11ec-955a-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: This particular behavior is typically executed when an adversary or malware
  gains access to an endpoint and begins to perform execution and to evade detections.
  Usually, a batch (.bat) file will be executed and multiple registry and scheduled
  task modifications will occur. During triage, review parallel processes and identify
  any further file modifications. Endpoint should be isolated.
data_source:
- Sysmon Event ID 13
search:
  selection1:
    Registry.registry_value_name: MpEnablePus
    TargetObject: '*\\Policies\\Microsoft\\Windows Defender\\MpEngine*'
    Details: '0x00000000'
  condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the registry value name, registry path, and registry value data from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA.
known_false_positives: admin or user may choose to disable windows defender product
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
tags:
  analytic_story:
  - IcedID
  - Windows Registry Abuse
  asset_type: Endpoint
  confidence: 70
  impact: 70
  message: modified/added/deleted registry entry $registry_path$ in $dest$
  mitre_attack_id:
  - T1562.001
  - T1562
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 49
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog