ADLOG-005: Directiva de protección contra alteraciones de Microsoft Defender
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Si tu EDR puede desactivarse desde el endpoint sin una acción administrativa, todo atacante lo desactivará como primer paso de su manual de operaciones. La protección contra alteraciones de Defender (y su equivalente en cualquier EDR moderno) bloquea la desactivación local. Esta comprobación busca los parámetros de GPO que rigen la protección en tiempo real de Defender: el estado completo de la protección contra alteraciones se establece en la nube (portal de Intune/MDE), pero el refuerzo del lado de GPO es verificable desde SYSVOL.
Por qué importa
Endpoint Detection and Response is the single highest-signal telemetry source most defenders have on Windows. Every modern intrusion playbook (Conti, BlackCat/ALPHV, LockBit, Akira, Scattered Spider, Volt Typhoon, FIN7) begins with an attempt to disable or evade the AV/EDR before staging payloads, dumping credentials, or moving laterally. MITRE catalogs this as T1562.001 (Impair Defenses: Disable or Modify Tools) and it is one of the most consistently observed sub-techniques across every major incident response report from CISA, Mandiant, Microsoft DART, and Sophos X-Ops. If an attacker who reaches local admin (or even SYSTEM via an unpatched service) can run Set-MpPreference -DisableRealtimeMonitoring $true, sc.exe stop WinDefend, or reg add a DisableAntiSpyware value and have Defender obey, the entire EDR investment is voided in a single command. Tamper Protection, introduced in Windows 10 1903 and Windows Server 2019 and managed through the Microsoft Defender for Endpoint cloud portal, prevents those exact commands from succeeding even when run as SYSTEM. The catch is that Tamper Protection is a cloud-managed setting, not a GPO. Operators who hardened Defender by GPO ten years ago often still have GPOs in place that explicitly allow users to disable real-time protection (the legacy "Allow users to pause scans" pattern), or have a sprawling Exclusions list that grants attackers free execution under any excluded path. Guerrilla surfaces both classes of misconfiguration. The blast radius of a missed Tamper Protection rollout is forest-wide: ransomware operators routinely push a GPO-deployed batch file or scheduled task that disables Defender on every domain-joined host before kicking off encryption. Tamper Protection blocks that pattern at the kernel; an unhardened GPO does not.
Ruta de ataque
Step 1: Foothold. The attacker establishes any local administrator context on a domain-joined host. Common paths: a Kerberoasted service account that is local admin via Restricted Groups GPO, a stale LAPS-less local admin password reused across the fleet, an exploited vulnerable application running as SYSTEM, or a phished user who runs a malicious installer that elevates via a UAC bypass. Step 2: EDR posture reconnaissance. From the foothold the attacker runs Get-MpPreference, Get-MpComputerStatus, and reg query HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /s. If TamperProtectionSource returns nothing and IsTamperProtected is False, Defender is operating under GPO control only and is fully scriptable. Step 3: Defender shutdown via supported APIs. With local admin (or SYSTEM via PsExec -s), the attacker runs Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Set-MpPreference -MAPSReporting Disabled; Set-MpPreference -SubmitSamplesConsent NeverSend. Without Tamper Protection every one of those calls succeeds and is logged only as a Defender configuration change, not as an alert. Step 4: Exclusion abuse. If Defender cannot be fully disabled (for example, an SCCM policy re-enables it on a cycle), the attacker adds an exclusion: Add-MpPreference -ExclusionPath "C:\ProgramData\OneDrive" or Add-MpPreference -ExclusionProcess "powershell.exe". Any binary dropped under the excluded path, or any child process of the excluded process, is invisible to Defender scanning. ADLOG-005 surfaces pre-existing GPO exclusions that already give attackers this capability without their needing local admin first. Step 5: Service tampering. As a belt-and-braces measure the attacker disables the WinDefend, WdNisSvc, Sense (MDE EDR agent), and SecurityHealthService services via sc.exe config WinDefend start= disabled and reboots. With Tamper Protection on, the service control manager rejects the change; without it, the service is gone after reboot. Step 6: Payload execution. With Defender muted, the attacker stages Mimikatz (sekurlsa::logonpasswords), Rubeus (Kerberoast and pass-the-ticket), SharpHound (collection), and the ransomware binary (Conti, LockBit 3.0, Akira, etc.) without triggering a single Defender alert. The kill chain from initial foothold to domain-wide encryption typically completes in under 48 hours, and the missing Defender telemetry is what makes that timeline possible. Step 7: Forest-wide propagation. The attacker, having reached Domain Admin (often via DCSync after Step 6), creates or modifies a GPO linked at the domain root that disables Defender on every member computer (Computer Configuration > Administrative Templates > Microsoft Defender Antivirus > Turn off Microsoft Defender Antivirus = Enabled). Within one gpupdate cycle every endpoint in the forest is blind. Tamper Protection blocks this final step because Tamper Protection is cloud-enforced and cannot be overridden by on-prem GPO.
Cómo lo evalúa Guerrilla
Guerrilla enumerates the forest with Get-ADForest, iterates every domain, and for each GPO retrieved via Get-GPO -All it parses the registry.pol file under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\registry.pol using the published GPO file format. The parser extracts every value under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and child keys: Real-Time Protection (DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection, DisableIOAVProtection, DisableScanOnRealtimeEnable), Reporting (DisableEnhancedNotifications), MpEngine (MpCloudBlockLevel, MpBafsExtendedTimeout), Spynet (SpynetReporting, SubmitSamplesConsent), Scan (DisableHeuristics, ScheduleDay), and Exclusions (Paths, Extensions, Processes, IpAddresses). The check produces a finding when DisableAntiSpyware is 1, when DisableRealtimeMonitoring is 1, when SubmitSamplesConsent is 2 (Never send) or MAPSReporting is 0 (Disabled), when any Exclusions value is present (the finding is then weighted by exclusion risk: wildcard paths and script-host process exclusions are High, narrow file-extension exclusions are Informational), and when SmartScreen policy values are absent or explicitly disabled. The check also records the GPO link scope (Site, Domain, OU) and the WMI filter (if any) so the operator can see which computers actually receive the policy. Because Tamper Protection is not a GPO setting, the check emits an explicit Informational finding instructing the operator to verify Tamper Protection state in the Microsoft Defender for Endpoint portal at Settings > Endpoints > Advanced features > Tamper Protection, or via Get-MpComputerStatus | Select-Object IsTamperProtected, TamperProtectionSource on a sample of endpoints. No Domain Admin is required; the check needs only Authenticated User read on SYSVOL, which is the default ACL.
Valor recomendado
El usuario local no puede deshabilitar la protección en tiempo real de Defender; las exclusiones están estrictamente controladas (o vacías); SmartScreen mejorado está activado. La protección contra alteraciones en sí se establece a través del portal en la nube de Microsoft Defender para Endpoint: verifícalo por otra vía.
Remediación
En el portal de MDE: Configuración > Endpoints > Características avanzadas > Protección contra alteraciones = Activada (aplicar a todos los dispositivos). En GPO: Configuración del equipo > Directivas > Plantillas administrativas > Componentes de Windows > Antivirus de Microsoft Defender > 'Desactivar el Antivirus de Microsoft Defender' = Deshabilitado (sí, doble negación: esto significa 'NO permitir desactivar Defender'). Además: > Protección en tiempo real > 'Desactivar la protección en tiempo real' = Deshabilitado. Revisa con atención la subclave de exclusiones: cada entrada ahí es un agujero que un atacante encontrará.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-3, SI-4
- CIS AD Benchmark
- 9.3.1
- MITRE ATT&CK
- T1562.001