T1211

Exploitation for Defense Evasion

Defense Evasion Last updated:

Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them. Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery. There have also been examples of vulnerabilities in public cloud infrastructure and SaaS applications that may bypass defense boundaries, evade security logs, or deploy hidden infrastructure.

What is T1211 Exploitation for Defense Evasion?

Exploitation for Defense Evasion (T1211) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Exploitation for Defense Evasion, covering the data sources and telemetry it touches: Process: Process Creation, Process: Process Access, Service: Service Modification, Microsoft Defender for Endpoint. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1211 Exploitation for Defense Evasion
Canonical reference
https://attack.mitre.org/techniques/T1211/
Microsoft Sentinel / Defender
kusto 
let SecurityProcesses = dynamic([
  "MsMpEng.exe", "MsSense.exe", "SenseCncProxy.exe", "SenseIR.exe",
  "csagent.exe", "CSFalconService.exe", "CSFalconContainer.exe",
  "SentinelAgent.exe", "SentinelServiceHost.exe", "SentinelStaticEngine.exe",
  "CylanceSvc.exe", "CylanceUI.exe",
  "cb.exe", "CbDefense.exe", "CbDefenseService.exe",
  "mbam.exe", "MBAMService.exe",
  "sophosssp.exe", "SophosSafestore.exe", "SAVService.exe",
  "avp.exe", "avpui.exe",
  "avgnt.exe", "avguard.exe",
  "SEDService.exe", "SpybotSD.exe",
  "aswBoot.exe", "AvastSvc.exe"
]);
let ExploitChildProcesses = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
  "bitsadmin.exe", "msiexec.exe", "csc.exe", "msbuild.exe",
  "wmic.exe", "net.exe", "net1.exe", "sc.exe"
]);
// Signal 1: Security software spawning suspicious child processes (post-exploitation execution)
let ExploitedSecurityProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (SecurityProcesses)
| where FileName has_any (ExploitChildProcesses)
| extend DetectionSignal = "SecuritySoftwareSpawnedSuspiciousChild"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSignal;
// Signal 2: Security processes accessing other processes with PROCESS_ALL_ACCESS or PROCESS_VM_WRITE
// (OpenProcess calls against security tools — precursor to exploitation)
let SecurityProcessAccess = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessAccessed"
| where FileName has_any (SecurityProcesses)
| where InitiatingProcessFileName !has_any (SecurityProcesses)
| where InitiatingProcessFileName !in~ ("System", "svchost.exe", "lsass.exe", "csrss.exe", "wininit.exe", "services.exe", "smss.exe")
| extend DetectionSignal = "SuspiciousAccessToSecurityProcess"
| project Timestamp, DeviceName, AccountName,
         FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSignal;
// Signal 3: Security service unexpectedly stopping (possible crash-based exploitation)
let SecurityServiceStop = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ServiceInstalled" or ActionType == "ServiceDeleted"
| where AdditionalFields has_any (SecurityProcesses)
| extend DetectionSignal = "SecurityServiceModifiedOrStopped"
| project Timestamp, DeviceName, AccountName,
         AdditionalFields, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSignal;
// Union all signals
union ExploitedSecurityProcess, SecurityProcessAccess, SecurityServiceStop
| sort by Timestamp desc

Detects exploitation of defensive security software via three correlated signals: (1) security processes spawning unexpected child processes such as cmd.exe or PowerShell, which may indicate code execution achieved through a vulnerability in the security software; (2) non-system processes opening handles to security software processes with suspicious access rights, which may precede exploitation; (3) unexpected modification or deletion of security service registrations. Uses DeviceProcessEvents and DeviceEvents tables from Microsoft Defender for Endpoint.

critical severity medium confidence

Data Sources

Process: Process Creation Process: Process Access Service: Service Modification Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceEvents

False Positives

  • Security software updates may spawn cmd.exe or PowerShell as part of self-update or installer routines
  • Endpoint management platforms (SCCM, Intune, BigFix) may access security software processes during health checks or remediation
  • Legitimate security tools performing process inspection (SysInternals, vulnerability scanners) may open handles to security processes
  • Vendor-provided diagnostic or support tools for the security product itself may trigger process access alerts
  • Windows Error Reporting (WerFault.exe) opens handles to crashed processes including security software during crash dump collection

Sigma rule & cross-platform mapping

The detection logic for Exploitation for Defense Evasion (T1211) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1211 Sigma rules on detection.fyi

Platform-specific guides for T1211

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-19 Research depth: deep
References (7)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Security Process Spawning Command Shell

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe (or the process running the test). Security Event ID 4688 if command line auditing is enabled. The detection signal 'SecuritySoftwareSpawnedSuspiciousChild' may not fire unless the initiating process name matches the security process list — use this test to validate the detection logic by temporarily adding 'powershell.exe' to the SecurityProcesses list in a test environment.

  2. Test 2Open Handle to Windows Defender Process (ProcessAccess Simulation)

    Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe, GrantedAccess=0x0400. Note: Windows Defender is Protected Process Light (PPL) — the OpenProcess call may be denied, but Sysmon still logs the attempt with CallTrace data showing the call stack.

  3. Test 3Security Service State Query and Stop Simulation (Non-Destructive)

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'sc query WinDefend' and 'sc query Sense'. Security Event ID 4688 (if enabled). Sysmon Event ID 1 for wmic.exe with CommandLine containing 'service where name'. These are the same reconnaissance commands used by threat actors (including APT28 tooling) to identify security software before exploitation.

  4. Test 4Exploit Artifact Simulation — Security Service Crash via WerFault

    Expected signal: Sysmon Event ID 1: Process Create for werfault.exe with command line containing '-p 0'. Application Event Log queries via wevtutil generate additional Sysmon Event ID 1 entries for wevtutil.exe. The WerFault invocation with PID 0 will fail but the process creation telemetry is generated and matches patterns seen when security software is exploited and crashes.

Response Playbook

Triage

  1. Identify the specific security software involved — which product, version, and patch level? Cross-reference against known CVEs for that product (e.g., CVE-2024-20399 for Cisco NX-OS, CVE-2015-4902 for Java, vendor-specific EDR vulnerabilities). Check vendor security advisories published within the last 90 days.
  2. Examine the child process spawned by or the accessor of the security software: what command line was executed? Is it a recognizable LOLBin pattern (e.g., cmd.exe /c whoami, powershell.exe -enc ...) or a more targeted exploit payload?
  3. Check whether the security software process crashed (look for Windows Error Reporting events, WerFault.exe spawns, or dump files in C:\ProgramData\Microsoft\Windows\WER\) immediately before or after the suspicious activity — a crash often accompanies exploitation.
  4. Determine the timeline: what user-initiated or network-initiated activity occurred immediately before the anomaly? Review DeviceNetworkEvents and DeviceLogonEvents in the 5-minute window preceding the alert to identify a potential initial trigger.
  5. Check whether the security software is still functional after the event — query the current service state, verify definitions are current, and determine if real-time protection is still enabled. A successful exploit may leave the software in a degraded or disabled state.
  6. Determine if this is an isolated event or affects multiple hosts. Spread across multiple endpoints simultaneously suggests an automated exploitation campaign or worm-like propagation targeting the security software.
  7. Review the affected endpoint's network connections at the time of the event — did the security process or a child process make outbound connections? Capture destination IPs and domains for threat intelligence enrichment.

Containment

  1. If code execution from the security process is confirmed: immediately isolate the endpoint from the network using EDR network isolation or VLAN quarantine to prevent lateral movement or C2 communication.
  2. Force-update the affected security software to the latest version if a known CVE is implicated — check vendor emergency advisories. For Defender, run 'Update-MpSignature' and verify engine version matches latest release.
  3. If the security software is confirmed disabled or degraded: deploy an alternate detection capability (e.g., enable additional Windows audit policies, deploy a secondary EDR in passive mode) to maintain visibility during remediation.
  4. Block the specific exploit vector at the network perimeter: if the exploit was delivered via a specific protocol, port, or document format, apply temporary ACLs or proxy blocks until the endpoint is patched.
  5. Preserve volatile memory and disk artifacts before remediation — take a full memory dump and disk snapshot for forensic analysis, particularly if a novel exploitation technique may have been used.
  6. Revoke and rotate credentials for any accounts that were active on the compromised endpoint at the time of exploitation — assume credential theft may have occurred if the security software was bypassed.
  7. Notify the affected security software vendor of the potential vulnerability exploitation, especially if the technique appears novel and the CVE is unconfirmed — vendors maintain emergency response contacts for zero-day reports.

Evidence Collection

  1. Windows Error Reporting dumps: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ and C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ — minidumps and crash metadata for the exploited process
  2. Application Event Log: Event IDs 1000 (Application Error) and 1001 (Windows Error Reporting) documenting the faulting module, exception code (e.g., 0xC0000005 for access violation), and fault offset
  3. Sysmon Event ID 10 (ProcessAccess): SourceImage, TargetImage, GrantedAccess flags, and CallTrace showing the call stack at time of handle acquisition
  4. Sysmon Event ID 1 (Process Create): full command lines of any processes spawned by or from the security software around the time of the incident
  5. Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash): any files written to disk by the exploited security process or its children
  6. Prefetch files for the security software executable: C:\Windows\Prefetch\ — execution timestamps and loaded DLLs can reveal unexpected library loads
  7. Memory artifacts: full process memory dump of the affected security software process (if still running) using Task Manager or ProcDump: procdump.exe -ma <pid> <output_path>
  8. Network packet capture from the time window of the exploitation — particularly any exploit delivery traffic preceding the anomaly
  9. Registry key HKLM\SYSTEM\CurrentControlSet\Services\ for the affected security service — check for tampered service binary paths, DLL load order entries, or modified failure actions

Escalation Criteria

  • ! Code execution confirmed from a security software process — any child process spawned by MsMpEng.exe, csagent.exe, SentinelAgent.exe, or equivalent with no corresponding update activity in vendor logs
  • ! Security software confirmed disabled or unresponsive after the exploitation event — real-time protection off, definitions stale, or service in stopped state without authorized change record
  • ! Novel or unpatched CVE implicated — the faulting module and exception offset do not match any public CVE for the identified product version, suggesting a potential zero-day
  • ! Evidence of lateral movement following the exploitation event — authentication events from the affected endpoint to other hosts using domain accounts shortly after the alert
  • ! Multiple endpoints showing the same exploitation pattern within a short window — indicates coordinated attack or automated exploitation tool targeting the environment
  • ! Successful privilege escalation post-exploitation — process tree showing SYSTEM-level child processes spawned from the compromised security process

Investigation Guide

Forensic Artifacts

  • > Windows Error Reporting crash reports: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ — contains minidumps, exception codes, and faulting module offsets for exploited processes
  • > Application Event Log: Event ID 1000 (faulting application) with exception code 0xC0000005 (access violation) or 0xC0000374 (heap corruption) in the exploited security process
  • > Sysmon Event ID 10 (ProcessAccess) logs: records GrantedAccess flags and CallTrace — look for PROCESS_VM_WRITE (0x0020) or PROCESS_ALL_ACCESS (0x1F0FFF) from unexpected source processes
  • > Prefetch: C:\Windows\Prefetch\ — MSMPENG.EXE-*.pf or equivalent for the exploited process — unusual DLL loads visible in prefetch metadata
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\<SecurityServiceName>\ — ImagePath, ServiceDll, FailureActions — tampered entries indicate persistence after exploitation
  • > File system: C:\Windows\System32\winevt\Logs\Application.evtx — Application event log containing crash and error entries for security software
  • > Memory: heap spray artifacts, ROP gadgets, or shellcode stubs may be recoverable from a process memory dump of the exploited security software
  • > Network captures: exploit delivery traffic often precedes the crash — PCAP from the 60-second window before the WER event may contain the exploit packet or malicious document delivery

Tuning Guidance

T1211 detections generate elevated false positive rates due to the similarity between exploitation artifacts and normal security software maintenance activities. Begin by building an authoritative inventory of your security software versions and their known update/maintenance behaviors — most EDR platforms document which system processes they spawn during updates. Whitelist specific parent process + child process + command line combinations that match your vendor's documented behavior, never wildcard entire source processes. For process access (Sysmon EID 10) alerts, start with GrantedAccess filtering: focus on 0x1F0FFF (PROCESS_ALL_ACCESS), 0x1F1FFF, and 0x143A (write + read + query) which are more indicative of exploitation than read-only access used by diagnostic tools. For service failure alerts, correlate with your patch management system — legitimate crashes during updates will cluster around maintenance windows. Cross-reference against NVD and vendor security advisories for your specific security product versions; detections should be prioritized when unpatched CVEs exist for the product. In cloud environments, supplement endpoint signals with CloudTrail (AWS) or Azure Activity Logs filtered for security service modifications, and monitor for the specific API calls documented in CVE write-ups (e.g., Service Catalog API abuse for CloudTrail bypass). Consider a 30-day baseline period before alerting to establish what normal process access patterns look like for your specific EDR product — the vendor's own processes will frequently appear as accessors of the main service.

Hunting Queries

Hunt for security software processes spawning LOLBin or script interpreter child processes over the past 7 days. Aggregated by hour and device to identify repeated exploitation attempts. A security process spawning cmd.exe or PowerShell is highly anomalous and indicates either exploitation or a misconfigured update mechanism.

Hunting — KQL
kql 
// Hunt for security processes that have crashed (WerFault accessing them) or spawned anomalous children
let SecurityProcesses = dynamic(["MsMpEng.exe","MsSense.exe","csagent.exe","CSFalconService.exe","SentinelAgent.exe","CylanceSvc.exe","cb.exe","CbDefense.exe","mbam.exe","sophosssp.exe","avp.exe","AvastSvc.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any (SecurityProcesses)
| summarize ChildProcesses=make_set(FileName), CommandLines=make_set(ProcessCommandLine), Count=count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where array_length(ChildProcesses) > 0
| extend SuspiciousChildren = set_intersect(ChildProcesses, dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe","msbuild.exe"]))
| where array_length(SuspiciousChildren) > 0
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval IsSecurityParent=if(match(ParentImage, "(?i)(MsMpEng|MsSense|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|CbDefense|mbam|sophosssp|avp\.exe|AvastSvc)"), 1, 0)
| where IsSecurityParent=1
| stats values(Image) as ChildImages, values(CommandLine) as ChildCmds, count as SpawnCount by host, ParentImage, span(_time, 1h)
| eval SuspiciousChildFound=if(mvfind(ChildImages, "(?i)(cmd\.exe|powershell|wscript|mshta|rundll32|certutil|bitsadmin|msbuild)") >= 0, 1, 0)
| where SuspiciousChildFound=1
| sort - _time

Hunt for non-trusted processes opening handles to security software over the past 7 days. Aggregated by source process to identify tools that repeatedly access security software — an exploit framework will typically call OpenProcess on the target before injecting or triggering the vulnerability. High access counts from a single source are particularly suspicious.

Hunting — KQL
kql 
// Hunt for high-privilege process access to security software from unusual source processes
let SecurityProcesses = dynamic(["MsMpEng.exe","MsSense.exe","csagent.exe","CSFalconService.exe","SentinelAgent.exe","CylanceSvc.exe","cb.exe","mbam.exe","sophosssp.exe","avp.exe","AvastSvc.exe"]);
let TrustedSources = dynamic(["svchost.exe","lsass.exe","services.exe","csrss.exe","wininit.exe","smss.exe","System","WerFault.exe","taskhostw.exe"]);
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "ProcessAccessed"
| where FileName has_any (SecurityProcesses)
| where not (InitiatingProcessFileName has_any (TrustedSources))
| where not (InitiatingProcessFileName has_any (SecurityProcesses))
| summarize AccessCount=count(), UniqueTargets=dcount(FileName), Targets=make_set(FileName) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by AccessCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| eval TargetIsSecurity=if(match(TargetImage, "(?i)(MsMpEng|MsSense|csagent|CSFalconService|SentinelAgent|CylanceSvc|cb\.exe|mbam|sophosssp|avp\.exe|AvastSvc)"), 1, 0)
| eval SourceTrusted=if(match(SourceImage, "(?i)(svchost\.exe|lsass\.exe|services\.exe|csrss\.exe|wininit\.exe|smss\.exe|WerFault\.exe|taskhostw\.exe)"), 1, 0)
| where TargetIsSecurity=1 AND SourceTrusted=0
| stats count as AccessCount, dc(TargetImage) as UniqueTargets, values(TargetImage) as Targets, values(GrantedAccess) as AccessRights by host, SourceImage, SourceCommandLine
| sort - AccessCount

Hunt for security service crash events (System Event IDs 7034/7036) correlated with suspicious process activity within a 5-minute window. Successful exploitation of security software often causes a service crash followed immediately by attacker-controlled command execution. This temporal correlation is a strong indicator of exploitation versus coincidental crashes.

Hunting — KQL
kql 
// Hunt for security service crashes correlated with subsequent suspicious process activity
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("ServiceInstalled", "ServiceDeleted")
| where AdditionalFields has_any ("Sense", "WinDefend", "Falcon", "SentinelAgent", "CylanceSvc", "CbDefense", "MBAMService", "SophosSafestore")
| join kind=inner (
    DeviceProcessEvents
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "sc.exe", "reg.exe")
    | project SuspiciousTime=Timestamp, DeviceName, SuspiciousProcess=FileName, SuspiciousCmd=ProcessCommandLine
) on DeviceName
| where abs(datetime_diff('minute', Timestamp, SuspiciousTime)) <= 5
| project Timestamp, DeviceName, AdditionalFields, SuspiciousProcess, SuspiciousCmd
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:System" (EventCode=7034 OR EventCode=7036)
| eval ServiceNameLower=lower(ServiceName)
| eval IsSecurityService=if(match(ServiceNameLower, "(sense|windefend|falcon|sentinelagent|cylancesvc|cbdefense|mbamservice|sophossafestore)"), 1, 0)
| where IsSecurityService=1
| eval crash_time=_time
| join type=inner host [
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\net.exe" OR Image="*\\sc.exe" OR Image="*\\reg.exe")
  | eval proc_time=_time
  | table host, proc_time, Image, CommandLine
]
| eval TimeDelta=abs(crash_time - proc_time)
| where TimeDelta <= 300
| table _time, host, ServiceName, EventCode, Image, CommandLine, TimeDelta
| sort - _time

Atomic Red Team Tests

Test 1 Simulate Security Process Spawning Command Shell
windows

Creates a test process that mimics the parent-child relationship of an exploited security process spawning a command interpreter. Uses PowerShell to launch cmd.exe with a parent process spoof simulation via Start-Process with explicit parent PID. This tests whether the detection fires on the child process spawn signal without requiring an actual vulnerability exploit. Run in a test environment only.

Command

powershell 
powershell.exe -Command "$psi = New-Object System.Diagnostics.ProcessStartInfo; $psi.FileName = 'cmd.exe'; $psi.Arguments = '/c whoami > $env:TEMP\df00tech-t1211-test.txt'; $psi.UseShellExecute = $false; [System.Diagnostics.Process]::Start($psi) | Out-Null; Write-Host 'T1211 simulation: cmd.exe spawned'"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-t1211-test.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe (or the process running the test). Security Event ID 4688 if command line auditing is enabled. The detection signal 'SecuritySoftwareSpawnedSuspiciousChild' may not fire unless the initiating process name matches the security process list — use this test to validate the detection logic by temporarily adding 'powershell.exe' to the SecurityProcesses list in a test environment.

Expected Detection

With initiating process in SecurityProcesses list: DetectionSignal=SecuritySoftwareSpawnedSuspiciousChild fires. Validates child process spawn detection path in both KQL (ExploitedSecurityProcess union branch) and SPL (EventCode=1, SecurityParent=1 AND SuspiciousChild=1).

Test 2 Open Handle to Windows Defender Process (ProcessAccess Simulation)
windows

Attempts to open a handle to the Windows Defender engine process (MsMpEng.exe) using OpenProcess via PowerShell P/Invoke. This simulates the reconnaissance or pre-exploitation step where an adversary acquires a handle to the target security process. The access right 0x0400 (PROCESS_QUERY_INFORMATION) is used — a lower-privilege access that is still anomalous from a non-system process. This does NOT exploit anything — it only opens and immediately closes a handle.

Command

powershell 
powershell.exe -Command "$sig = 'using System; using System.Runtime.InteropServices; public class Win32 { [DllImport(""kernel32.dll"")] public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, uint dwProcessId); [DllImport(""kernel32.dll"")] public static extern bool CloseHandle(IntPtr hObject); }'; Add-Type -TypeDefinition $sig; $p = Get-Process -Name MsMpEng -ErrorAction SilentlyContinue; if ($p) { $h = [Win32]::OpenProcess(0x0400, $false, $p.Id); if ($h -ne [IntPtr]::Zero) { Write-Host "Handle acquired: $h"; [Win32]::CloseHandle($h) | Out-Null } else { Write-Host 'OpenProcess failed (expected on protected process)' } } else { Write-Host 'MsMpEng not found' }"

Expected Telemetry

Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe, GrantedAccess=0x0400. Note: Windows Defender is Protected Process Light (PPL) — the OpenProcess call may be denied, but Sysmon still logs the attempt with CallTrace data showing the call stack.

Expected Detection

SPL query EventCode=10 fires with TargetIsSecurity=1 and SourceTrusted=0. KQL DeviceEvents with ActionType=ProcessAccessed and FileName matching MsMpEng.exe fires the SecurityProcessAccess detection signal. Validates the process access detection path.

Test 3 Security Service State Query and Stop Simulation (Non-Destructive)
windows

Queries the current state of Windows Defender service and simulates the pre-exploitation reconnaissance an adversary would perform before attempting to crash or exploit a security service. Uses sc.exe to query the service state — this is exactly what tools like Mimikatz and other post-exploitation frameworks do before targeting security software. Does NOT stop or modify the service.

Command

powershell 
cmd.exe /c "sc query WinDefend && sc query Sense && sc query MdCoreSvc && wmic service where name='WinDefend' get Name,State,PathName && tasklist /FI "IMAGENAME eq MsMpEng.exe" /V"

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'sc query WinDefend' and 'sc query Sense'. Security Event ID 4688 (if enabled). Sysmon Event ID 1 for wmic.exe with CommandLine containing 'service where name'. These are the same reconnaissance commands used by threat actors (including APT28 tooling) to identify security software before exploitation.

Expected Detection

This test validates the security software discovery detection (T1518.001) which typically precedes T1211. The sc.exe and wmic.exe process creation events should appear in hunting queries. In environments with T1518.001 detections deployed, alerts will fire on the service enumeration pattern.

Test 4 Exploit Artifact Simulation — Security Service Crash via WerFault
windows

Simulates the Windows Error Reporting artifacts generated when a security process crashes by invoking WerFault.exe with a dummy PID. This tests the detection and evidence collection paths for crash-based exploitation without actually crashing anything. Real exploitation of security software (e.g., heap overflow in AV engine parsing a malformed file) would generate the same WerFault invocation and Application Event ID 1000 entries.

Command

powershell 
cmd.exe /c "werfault.exe -u -p 0 -s 64 2>nul & echo WerFault simulation complete & wevtutil qe Application /q:"*[System[Provider[@Name='Application Error'] and EventID=1000]]" /c:3 /f:text"

Expected Telemetry

Sysmon Event ID 1: Process Create for werfault.exe with command line containing '-p 0'. Application Event Log queries via wevtutil generate additional Sysmon Event ID 1 entries for wevtutil.exe. The WerFault invocation with PID 0 will fail but the process creation telemetry is generated and matches patterns seen when security software is exploited and crashes.

Expected Detection

Sysmon EID 1 for WerFault.exe and wevtutil.exe appear in process creation logs. Validates that the evidence collection path (Application Event Log querying) is functioning. Correlate with the hunting query that joins security service events with subsequent suspicious process activity.

Related Detections

Tactic Hub

TA0005Defense Evasion

Related Techniques

T1518.001Security Software DiscoveryT1562.001Disable or Modify ToolsT1562.004Disable or Modify System FirewallT1055Process InjectionT1574Hijack Execution FlowT1190Exploit Public-Facing ApplicationT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Defense Evasion

Popular Detections