ADLOG-005: Microsoft Defender Tamper Protection Policy
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates Group Policy Objects that target Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus and parses the corresponding registry.pol entries under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection. Specifically it reads: DisableAntiSpyware (value 1 means Defender AV is disabled via policy, which is the GPO ADMX setting "Turn off Microsoft Defender Antivirus" set to Enabled), DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection (IOAV), DisableScanOnRealtimeEnable, DisableIOAVProtection, and SubmitSamplesConsent. It walks the Exclusions subkey and enumerates the Paths, Extensions, Processes, and IpAddresses values, flagging wildcard paths (C:\*, C:\Windows\Temp\*), broad process exclusions (powershell.exe, cmd.exe, wscript.exe), and any exclusion path that is user-writable. It also reads HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen and HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen to confirm Enhanced Phishing Protection and Network Protection state. Finally, the check records the absence of any TamperProtection-related GPO override (there is no GPO that turns Tamper Protection on or off; this is intentional and the check emits an informational reminder to verify Settings > Endpoints > Advanced features > Tamper Protection = On in the MDE portal). The check does not read live machine state from endpoints; it audits the policy that will be applied at next gpupdate, which is the durable, forest-wide control surface.
Por qué importa
Endpoint Detection and Response is the single highest-signal telemetry source most defenders have on Windows. Every modern intrusion playbook (Conti, BlackCat/ALPHV, LockBit, Akira, Scattered Spider, Volt Typhoon, FIN7) begins with an attempt to disable or evade the AV/EDR before staging payloads, dumping credentials, or moving laterally. MITRE catalogs this as T1562.001 (Impair Defenses: Disable or Modify Tools) and it is one of the most consistently observed sub-techniques across every major incident response report from CISA, Mandiant, Microsoft DART, and Sophos X-Ops. If an attacker who reaches local admin (or even SYSTEM via an unpatched service) can run Set-MpPreference -DisableRealtimeMonitoring $true, sc.exe stop WinDefend, or reg add a DisableAntiSpyware value and have Defender obey, the entire EDR investment is voided in a single command. Tamper Protection, introduced in Windows 10 1903 and Windows Server 2019 and managed through the Microsoft Defender for Endpoint cloud portal, prevents those exact commands from succeeding even when run as SYSTEM. The catch is that Tamper Protection is a cloud-managed setting, not a GPO. Operators who hardened Defender by GPO ten years ago often still have GPOs in place that explicitly allow users to disable real-time protection (the legacy "Allow users to pause scans" pattern), or have a sprawling Exclusions list that grants attackers free execution under any excluded path. Guerrilla surfaces both classes of misconfiguration. The blast radius of a missed Tamper Protection rollout is forest-wide: ransomware operators routinely push a GPO-deployed batch file or scheduled task that disables Defender on every domain-joined host before kicking off encryption. Tamper Protection blocks that pattern at the kernel; an unhardened GPO does not.
Ruta de ataque
Step 1: Foothold. The attacker establishes any local administrator context on a domain-joined host. Common paths: a Kerberoasted service account that is local admin via Restricted Groups GPO, a stale LAPS-less local admin password reused across the fleet, an exploited vulnerable application running as SYSTEM, or a phished user who runs a malicious installer that elevates via a UAC bypass. Step 2: EDR posture reconnaissance. From the foothold the attacker runs Get-MpPreference, Get-MpComputerStatus, and reg query HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /s. If TamperProtectionSource returns nothing and IsTamperProtected is False, Defender is operating under GPO control only and is fully scriptable. Step 3: Defender shutdown via supported APIs. With local admin (or SYSTEM via PsExec -s), the attacker runs Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Set-MpPreference -MAPSReporting Disabled; Set-MpPreference -SubmitSamplesConsent NeverSend. Without Tamper Protection every one of those calls succeeds and is logged only as a Defender configuration change, not as an alert. Step 4: Exclusion abuse. If Defender cannot be fully disabled (for example, an SCCM policy re-enables it on a cycle), the attacker adds an exclusion: Add-MpPreference -ExclusionPath "C:\ProgramData\OneDrive" or Add-MpPreference -ExclusionProcess "powershell.exe". Any binary dropped under the excluded path, or any child process of the excluded process, is invisible to Defender scanning. ADLOG-005 surfaces pre-existing GPO exclusions that already give attackers this capability without their needing local admin first. Step 5: Service tampering. As a belt-and-braces measure the attacker disables the WinDefend, WdNisSvc, Sense (MDE EDR agent), and SecurityHealthService services via sc.exe config WinDefend start= disabled and reboots. With Tamper Protection on, the service control manager rejects the change; without it, the service is gone after reboot. Step 6: Payload execution. With Defender muted, the attacker stages Mimikatz (sekurlsa::logonpasswords), Rubeus (Kerberoast and pass-the-ticket), SharpHound (collection), and the ransomware binary (Conti, LockBit 3.0, Akira, etc.) without triggering a single Defender alert. The kill chain from initial foothold to domain-wide encryption typically completes in under 48 hours, and the missing Defender telemetry is what makes that timeline possible. Step 7: Forest-wide propagation. The attacker, having reached Domain Admin (often via DCSync after Step 6), creates or modifies a GPO linked at the domain root that disables Defender on every member computer (Computer Configuration > Administrative Templates > Microsoft Defender Antivirus > Turn off Microsoft Defender Antivirus = Enabled). Within one gpupdate cycle every endpoint in the forest is blind. Tamper Protection blocks this final step because Tamper Protection is cloud-enforced and cannot be overridden by on-prem GPO.
Cómo lo evalúa Guerrilla
Guerrilla enumerates the forest with Get-ADForest, iterates every domain, and for each GPO retrieved via Get-GPO -All it parses the registry.pol file under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\registry.pol using the published GPO file format. The parser extracts every value under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and child keys: Real-Time Protection (DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection, DisableIOAVProtection, DisableScanOnRealtimeEnable), Reporting (DisableEnhancedNotifications), MpEngine (MpCloudBlockLevel, MpBafsExtendedTimeout), Spynet (SpynetReporting, SubmitSamplesConsent), Scan (DisableHeuristics, ScheduleDay), and Exclusions (Paths, Extensions, Processes, IpAddresses). The check produces a finding when DisableAntiSpyware is 1, when DisableRealtimeMonitoring is 1, when SubmitSamplesConsent is 2 (Never send) or MAPSReporting is 0 (Disabled), when any Exclusions value is present (the finding is then weighted by exclusion risk: wildcard paths and script-host process exclusions are High, narrow file-extension exclusions are Informational), and when SmartScreen policy values are absent or explicitly disabled. The check also records the GPO link scope (Site, Domain, OU) and the WMI filter (if any) so the operator can see which computers actually receive the policy. Because Tamper Protection is not a GPO setting, the check emits an explicit Informational finding instructing the operator to verify Tamper Protection state in the Microsoft Defender for Endpoint portal at Settings > Endpoints > Advanced features > Tamper Protection, or via Get-MpComputerStatus | Select-Object IsTamperProtected, TamperProtectionSource on a sample of endpoints. No Domain Admin is required; the check needs only Authenticated User read on SYSVOL, which is the default ACL.
Valor recomendado
Defender real-time protection cannot be disabled by the local user; exclusions are tightly governed (or empty); SmartScreen Enhanced is on. Tamper Protection itself is set via Microsoft Defender for Endpoint cloud portal — verify out-of-band.
Remediación
In the MDE portal: Settings > Endpoints > Advanced features > Tamper Protection = On (apply to all devices). In GPO: Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus > 'Turn off Microsoft Defender Antivirus' = Disabled (yes, double-negative — this means 'do NOT allow turning Defender off'). Also: > Real-Time Protection > 'Turn off real-time protection' = Disabled. Review the Exclusions subkey carefully — every entry there is a hole an attacker will find.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-3, SI-4
- CIS AD Benchmark
- 9.3.1
- MITRE ATT&CK
- T1562.001