Attackers who gain execution on a system may attempt to reduce visibility before continuing their activity. Disabling endpoint protection, stopping audit services, clearing logs, or blocking security telemetry are all important behaviors for a SOC to monitor.
The source defines a cross-platform hunt that combines Windows process telemetry with Linux log indicators.
Windows Defense-Evasion Indicators
The Windows portion of the query looks for command lines containing actions such as:
Set-MpPreference;DisableRealtimeMonitoring;stopping Windows Defender;
clearing event logs with
wevtutil;clearing audit policy;
disabling firewall controls.
Linux Defense-Evasion Indicators
The Linux side searches full logs for actions such as:
setenforce 0;stopping
auditd;modifying iptables;
blocking ports 514 or 6514 used for log transport.
Detection Query
(data.win.system.eventID:1 and data.win.eventdata.commandLine:(*Set-MpPreference* or *DisableRealtimeMonitoring* or *sc*stop*WinDefend* or *wevtutil*cl* or *auditpol*clear* or *netsh*firewall*disable*)) or full_log:("setenforce 0" or "systemctl stop auditd" or "service auditd stop" or "iptables -A OUTPUT" or "dport 514 -j DROP" or "dport 6514 -j DROP")The source recorded 13,751 matching events during the previous 30 days.
Why the Volume Needs Analysis
Administrative tools and maintenance scripts can legitimately change security settings. A raw query for these commands may therefore include expected activity.
The most useful next step is to identify:
which commands generate the most matches;
which hosts execute them;
which accounts are involved;
whether they occur during approved maintenance;
whether they coincide with other suspicious events.
The same command can have very different meaning depending on context.
Investigation Priorities
Events should receive higher priority when security controls are modified:
immediately after suspicious process execution;
by an unexpected user;
on production servers;
shortly before persistence or credential access;
together with outbound tunneling or ransomware commands.
Analysts should determine whether the security setting was later restored and whether logging gaps were created.
Tuning Strategy
Do not simply exclude all use of a command such as Set-MpPreference. Instead, document approved automation and constrain exclusions by host, account, command line, and expected schedule.
This preserves visibility into the same command when it appears elsewhere.
Correlation Value
Defense evasion is especially important as part of an attack sequence.
For example:
web application RCE → PowerShell → Defender disabled → persistence created
is much more meaningful than any single event.
Operational Value
Security controls exist to create visibility. Attempts to disable those controls should therefore remain a core part of threat hunting.
Even in environments with legitimate administrative use, baselining and correlation can transform a noisy command hunt into a valuable post-exploitation detection.
