Threat Hunting Exercise: Analyzing Windows Defender Tampering PowerShell Dataset

This hunt targets a near-universal pre-payload step: a simulated Windows Security + Sysmon + Defender operational log dataset (defender_tampering_powershell_2022-10-03T093000.json) capturing T1562.001: Impair Defenses - Disable or Modify Tools, where an adversary with local admin rights disables or weakens Windows Defender via PowerShell cmdlets before dropping a payload that would otherwise be caught on write.

Step 1: Hypothesis Formation

Hypothesis: Adversary with local admin access runs a sequence of Set-MpPreference PowerShell cmdlets to disable real-time protection, add broad exclusions (entire drive letters or user profile paths), and disable cloud-delivered protection/sample submission, immediately before dropping and executing an unsigned binary that would normally trigger AV. Indicators:

Microsoft-Windows-Windows Defender/Operational Event 5001 (real-time protection disabled) or 5010/5012 (feature disabled).
Security 4688/Sysmon 1: powershell.exe with cmdline containing Set-MpPreference -DisableRealtimeMonitoring $true or -ExclusionPath.
Sysmon Event 11: File creation of an unsigned executable immediately following the Defender changes, in a path that was just added as an exclusion.
No corresponding change-management ticket or EDR-vendor-migration context for the tamper event.

Null Hypothesis: Legitimate AV exclusion added for a known-compatibility issue (e.g., excluding a backup application's working directory) or an approved EDR migration disabling the legacy product. Invalidate via the exclusion scope (entire drive vs. narrow app-specific folder) and the immediate drop-and-execute of an unsigned binary in the newly-excluded path.

Rationale: This hunt is deliberately positioned as a "trigger" for the entire rest of the kill chain in this series - from macro-delivered loaders to ransomware - because defense impairment is almost always attempted before the truly damaging payload lands, making it one of the earliest reliable tripwires available.

Step 2: Data Sources and Scope

Sources: Microsoft-Windows-Windows Defender/Operational (5001, 5004, 5007, 5010, 5012); Security (4688 cmdline); Sysmon (1 proc create, 11 file create).
Scope: ~2022-10-03T09:30:00-09:31:20 UTC; Host: WORKSTATION31.theshire.local; Account: wardog (local admin, likely already compromised per prior hunts in this series).
SIEM Queries (Splunk/ELK):
Defender events: index=defender_operational EventID IN (5001,5010,5012)
Cmdline: index=security EventID=4688 CommandLine="Set-MpPreference" AND (CommandLine="DisableRealtimeMonitoring" OR CommandLine="ExclusionPath")
Drop-after-tamper: index=sysmon EventID=11 | join Hostname [search index=defender_operational EventID=5001 earliest=-2m]

Step 3: Key Findings

Parsed events (9 shown) show a complete, scripted Defender-disable sequence followed within seconds by an unsigned payload drop into the newly-excluded path.

Timestamp (UTC)	Event ID/Source	Key Details	IOC/Why Suspicious?
2022-10-03 09:30:00	4688 / Security	NewProcessName=powershell.exe; CommandLine="powershell -ep bypass -c \"Set-MpPreference -DisableRealtimeMonitoring $true\""; SubjectUserName=wardog.	Core IOC: Real-time protection explicitly disabled via PowerShell - the single highest-value Defender-tamper indicator.
2022-10-03 09:30:00	5001 / Defender Operational	"Real-time protection was turned off."; triggered by process=powershell.exe.	Native Defender telemetry corroborates the cmdlet's effect - protection is now confirmed off, not just attempted.
2022-10-03 09:30:02	4688 / Security	CommandLine="powershell -c \"Set-MpPreference -ExclusionPath 'C:\\Users\\Public\\'\"".	Evasion IOC: Broad exclusion added for an entire world-writable directory rather than a narrow app path - no legitimate compatibility fix needs this scope.
2022-10-03 09:30:03	4688 / Security	CommandLine="powershell -c \"Set-MpPreference -DisableIOAVProtection $true -SubmitSamplesConsent 2 -MAPSReporting 0\"".	Cloud-evasion IOC: Disables IE/Office download-scan integration and opts out of cloud sample submission/MAPS - actor is specifically preventing this payload from ever reaching Microsoft's cloud detection pipeline.
2022-10-03 09:30:04	5010 / Defender Operational	"Scanning for malware and other potentially unwanted software was disabled."	Confirms the full scan engine, not just real-time monitoring, is now off.
2022-10-03 09:30:10	11 (File Create) / Sysmon	Image=powershell.exe; TargetFilename=C:\Users\Public\svchost32.exe (34MB, unsigned).	Payload IOC: Large unsigned binary dropped directly into the just-excluded path - timing makes the intent unambiguous.
2022-10-03 09:30:12	1 (Proc Create) / Sysmon	Image=C:\Users\Public\svchost32.exe; ParentImage=powershell.exe.	Payload executes with zero AV interference, exactly as intended by the preceding tamper sequence.
2022-10-03 09:30:15	3 (Net Connect) / Sysmon	Image=svchost32.exe; DestinationIp=185.220.101.61 (same infrastructure as the earlier macro-loader hunt in this series); DestinationPort=443.	Correlation IOC: C2 destination matches known infrastructure from the Office Macro hunt - same campaign, different delivery/evasion stage.
2022-10-03 09:31:20	4688 / Security	CommandLine="powershell -c \"Set-MpPreference -DisableRealtimeMonitoring $false\"".	Cover IOC: Actor re-enables real-time monitoring after the payload is running - reduces the visible "Defender is off" window to under 2 minutes to evade periodic compliance/posture checks.

Validation:

Timeline: Full disable → exclusion → cloud-evasion → payload drop → execution → C2 → re-enable, all within 90 seconds - a single scripted operation, not incremental manual tweaking.
False Positives: No documented EDR migration or compatibility exception exists for WORKSTATION31; C:\Users\Public\ is never a legitimate application install/working directory at this organization.
Correlation: The re-enable step at the end and the matching C2 IP to a previously-hunted campaign both strengthen attribution and confirm this is the same actor progressing through their playbook, not an isolated event.

Step 4: Recommendations & Next Steps

Response: Isolate WORKSTATION31; remove all added exclusions and re-verify Defender configuration via Group Policy re-push; kill/quarantine svchost32.exe; treat wardog's credentials as compromised (chain to the earlier hunts in this series involving this account) and reset.
Detection: Sigma: title: Defender Tampering via PowerShell → selection: EventID=4688 CommandLine contains 'Set-MpPreference' AND (contains 'DisableRealtimeMonitoring' OR contains 'ExclusionPath') combined with EventID=5001 corroboration - should be a standing P1 alert, not hunt-only.
Pro Tip: Enable Tamper Protection (Set-MpPreference and friends are blocked outright when Tamper Protection is on) - this single Defender feature would have prevented the entire sequence above regardless of the admin-level access the actor already had.

Hypothesis confirmed - scripted Defender tampering directly enabling unsigned payload execution, tied to known campaign infrastructure from earlier in this series! Defense-impairment hunts like this one are among the highest-leverage tripwires available before real damage occurs.