Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

Microsoft Defender protection disabled via Set-MpPreference (T1685)

AQLhighconfidence 75/100generated 2026-10-18

Set-MpPreference switching off Defender real-time, behaviour, IOAV or script scanning — commonly done right before payload delivery. Observed for: APT2, APT35, APT5, blackbyte, Contagious Interview, FIN6 and 21 more.

ATT&CK
T1685 mitre ↗
Linked actors
APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · Gamaredon Group · incransom · INDRIK SPIDER · Kimsuky · Medusa Group · MirrorFace · MuddyWater · Pink Sandstorm · play · Rocke · Scattered Spider · Storm-1567 · TA2541 · TA505 · TeamTNT · The Gorgon Group · Tick · Turla · UNC3886 · Velvet Ant · WIZARD SPIDER
False positives
Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

AQL search

skopnix-qradar-ttp-t1685-a106e0c7.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE "Process CommandLine" ILIKE '%set-mppreference%' AND ("Process CommandLine" ILIKE '%disablerealtimemonitoring%' OR "Process CommandLine" ILIKE '%disablebehaviormonitoring%' OR "Process CommandLine" ILIKE '%disableioavprotection%' OR "Process CommandLine" ILIKE '%disablescriptscanning%')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: Microsoft Defender protection disabled via Set-MpPreference (T1685)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process CommandLine" ILIKE '%set-mppreference%' AND ("Process CommandLine" ILIKE '%disablerealtimemonitoring%' OR "Process CommandLine" ILIKE '%disablebehaviormonitoring%' OR "Process CommandLine" ILIKE '%disableioavprotection%' OR "Process CommandLine" ILIKE '%disablescriptscanning%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1685".
FP-safety: Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References