sysmon-config icon indicating copy to clipboard operation
sysmon-config copied to clipboard

Published 20 hours ago • verified publisher icon SwiftOnSecurity

Update the Antivirus Tampering configuration, using general condition

Open hieuttmmo opened this issue 2 years ago • 1 comments

As mentioned in the DFIR Report, another techniques might be use to disable Defender Real-Time Protection mechanism. So in this PR, i want to use a general condition for monitor all changes in the Defender Registry Path.

  • DFIR Report: https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  • Disable Defender Script: https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105

hieuttmmo avatar Oct 18 '21 05:10 hieuttmmo

FYI: Already tested this config on my home-lab and it worked great.

hieuttmmo avatar Oct 18 '21 05:10 hieuttmmo