PUA - DefenderCheck Execution

Title: PUA - DefenderCheck Execution
Status: test
Description:Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.
References:
  -https://github.com/matterpreter/DefenderCheck
Author: Florian Roth (Nextron Systems)
Date: 2022-08-30
modified:2023-02-04
Tags:

• -'attack.stealth'
• -'attack.t1027.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\DefenderCheck.exe' Description:'DefenderCheck'   condition:selection
Falsepositives:
  -Unlikely
Level: high