PowerShell Defense Impairment via Set-MpPreference

Adversaries frequently target security software to minimize detection risks during post-exploitation activities. A common technique involves abusing the native PowerShell cmdlet 'Set-MpPreference' to impair Windows Defender. By modifying preference parameters, an attacker can disable essential security components such as real-time monitoring, intrusion prevention, script scanning, and behavior monitoring. Additionally, attackers can downgrade the default actions taken upon detecting threats, effectively instructing the security engine to 'Allow' malicious activity. This technique is typically employed following initial access, once the attacker has gained administrative privileges required to interact with the Defender configuration API. Defenders should monitor PowerShell Script Block Logging events for the usage of these specific modification flags to identify unauthorized defense impairment attempts.

Attack Chain

1. Attacker achieves initial access on a Windows endpoint.
2. Attacker escalates privileges to local administrator or SYSTEM to gain configuration access.
3. Attacker identifies the security suite as Windows Defender (Microsoft Defender Antivirus).
4. Attacker launches a PowerShell process to interact with the Windows Defender WMI namespace.
5. Attacker executes 'Set-MpPreference' with flags such as '-DisableRealtimeMonitoring $true' or '-DisableBehaviorMonitoring $true'.
6. Attacker modifies threat response settings (e.g., 'HighThreatDefaultAction Allow') to ensure future malicious payloads are ignored.
7. Attacker proceeds with further activity, such as deploying ransomware or backdoors, without intervention from the antivirus engine.

Impact

Successful execution of this technique results in the neutralization of the primary endpoint security controls. This allows attackers to execute, move laterally, and exfiltrate data while remaining invisible to Windows Defender alerts. The impact includes unhindered deployment of secondary malware, loss of data integrity, and prolonged dwell time within the targeted environment.

Recommendation

Prioritize the implementation of PowerShell Script Block Logging across all Windows endpoints to capture the specific command-line arguments mentioned in this brief. Deploy the provided Sigma rule to alert on unauthorized configuration changes to the antivirus agent. Investigate any instances where 'Set-MpPreference' is invoked outside of defined maintenance windows or sanctioned administrative scripts.