Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

Microsoft Defender protection disabled via Set-MpPreference (T1685)

SIGhighconfidence 75/100generated 2026-10-18

Set-MpPreference switching off Defender real-time, behaviour, IOAV or script scanning — commonly done right before payload delivery. Observed for: APT2, APT35, APT5, blackbyte, Contagious Interview, FIN6 and 21 more.

ATT&CK
T1685 mitre ↗
Linked actors
APT2 · APT35 · APT5 · blackbyte · Contagious Interview · FIN6 · Gamaredon Group · incransom · INDRIK SPIDER · Kimsuky · Medusa Group · MirrorFace · MuddyWater · Pink Sandstorm · play · Rocke · Scattered Spider · Storm-1567 · TA2541 · TA505 · TeamTNT · The Gorgon Group · Tick · Turla · UNC3886 · Velvet Ant · WIZARD SPIDER
False positives
Requires Set-MpPreference together with a Disable* protection switch; exclusion management alone does not match. The value is not parsed — a re-enable ($false) also matches, so review before auto-response.

Sigma rule

skopnix-sigma-ttp-t1685-f69e0526.ymldownload .yml ↓
title: Skopnix - Microsoft Defender protection disabled via Set-MpPreference (T1685)
id: 693f8451-e33b-5a02-a357-130a869fd011
status: experimental
description: 'Set-MpPreference switching off Defender real-time, behaviour, IOAV or script scanning — commonly done right before payload delivery. Observed for: APT2, APT35, APT5, blackbyte, Contagious Interview, FIN6 and 21 more.'
references:
  - https://attack.mitre.org/techniques/T1685/
  - https://skopnix.com/actors/apt2
  - https://skopnix.com/actors/apt35
  - https://skopnix.com/actors/apt5
  - https://skopnix.com/actors/blackbyte
  - https://skopnix.com/actors/contagious-interview
  - https://skopnix.com/actors/fin6
  - https://skopnix.com/actors/gamaredon-group
  - https://skopnix.com/actors/incransom
  - https://skopnix.com/actors/indrik-spider
  - https://skopnix.com/actors/kimsuky
author: skopnix
date: '2026-10-18'
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdlet:
    CommandLine|contains: Set-MpPreference
  selection_switch:
    CommandLine|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection
      - DisableScriptScanning
  condition: all of selection_*
falsepositives:
  - Scripts that re-enable protection with the same switches set to $false (review the value); third-party AV installers that disable Defender
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References