From 4496e3e4e155d80f9a227b1538a95c35413c3f69 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Wed, 22 Jul 2026 15:13:54 +0800 Subject: [PATCH 1/8] Add CLSID/IIDs for Windows Security Center Signed-off-by: Still Hsu --- ...gister-windows-security-center-product.yml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 nursery/register-windows-security-center-product.yml diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml new file mode 100644 index 000000000..5ca7eaa27 --- /dev/null +++ b/nursery/register-windows-security-center-product.yml @@ -0,0 +1,28 @@ +rule: + meta: + name: register Windows Security Center product + namespace: impact/features + authors: + - still@teamt5.org + scopes: + static: function + dynamic: unsupported # requires bytes features + att&ck: + - Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001] + mbc: + - Defense Evasion::Disable or Evade Security Tools [F0004] + references: + - https://github.com/es3n1n/defendnot + - https://github.com/Feng-Teng/Microsoft-Defender/ + features: + - and: + - api: ole32.CoCreateInstance + - bytes: 37 2C 10 F2 C3 90 0C 45 B3 F6 92 BE 16 93 BD F2 = CLSID_WindowsSecurityCenterISVAPI + - or: + - bytes: 56 97 4E 02 6C BA D1 4A 83 21 87 BA E7 8F D0 E3 = IID_IWscASStatus + - bytes: 6E 6C 8F 9B 4A 8A 91 48 AF 63 1A 2F 50 92 40 40 = IID_IWscFWStatus + - bytes: CB 98 F6 62 4A 09 68 4C 94 19 8E 8C 49 42 0E 59 = IID_IWscFWStatus2 + - bytes: 65 A7 01 39 91 AB A9 4B A5 53 5B 85 38 DE B8 40 = IID_IWscAVStatus + - bytes: 96 9C 6D 20 DF AC 4B 48 83 3E DE B9 14 56 5E 44 = IID_IWscAVStatus2 + - bytes: A2 7C 00 CF E3 F5 E5 11 9C E9 5E 55 17 50 7C 66 = IID_IWscAVStatus3 + - bytes: AC AF CB 4D BA 29 B1 46 80 FC B8 BD E3 C0 AE 4D = IID_IWscAVStatus4 \ No newline at end of file From 3b646120c7b2f773d5d3920464a3b6bca6f950ec Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Wed, 22 Jul 2026 15:15:41 +0800 Subject: [PATCH 2/8] Add example testfile Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 5ca7eaa27..64e2c41a6 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -14,6 +14,8 @@ rule: references: - https://github.com/es3n1n/defendnot - https://github.com/Feng-Teng/Microsoft-Defender/ + examples: + - f5449806ad50242a4df9186455434b5957f3fc2044d85a9f1d9135a542b678cc features: - and: - api: ole32.CoCreateInstance From 8b41511ec230db842621ee18a636b2809c9c0069 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Wed, 22 Jul 2026 15:16:52 +0800 Subject: [PATCH 3/8] Fix linting Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 64e2c41a6..5f462871f 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -27,4 +27,4 @@ rule: - bytes: 65 A7 01 39 91 AB A9 4B A5 53 5B 85 38 DE B8 40 = IID_IWscAVStatus - bytes: 96 9C 6D 20 DF AC 4B 48 83 3E DE B9 14 56 5E 44 = IID_IWscAVStatus2 - bytes: A2 7C 00 CF E3 F5 E5 11 9C E9 5E 55 17 50 7C 66 = IID_IWscAVStatus3 - - bytes: AC AF CB 4D BA 29 B1 46 80 FC B8 BD E3 C0 AE 4D = IID_IWscAVStatus4 \ No newline at end of file + - bytes: AC AF CB 4D BA 29 B1 46 80 FC B8 BD E3 C0 AE 4D = IID_IWscAVStatus4 From d091fad6d630437f3a34a9089c6576b3d29f66c5 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 25 Jul 2026 21:49:49 +0800 Subject: [PATCH 4/8] Add description and address match Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 5f462871f..601d0bd00 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -15,7 +15,8 @@ rule: - https://github.com/es3n1n/defendnot - https://github.com/Feng-Teng/Microsoft-Defender/ examples: - - f5449806ad50242a4df9186455434b5957f3fc2044d85a9f1d9135a542b678cc + - f5449806ad50242a4df9186455434b5957f3fc2044d85a9f1d9135a542b678cc:0x18000d090 + description: Match CLSID/IIDs used when making COM calls to the Windows Security Center component; may be to impair Windows Defender by registering itself as a security solution. features: - and: - api: ole32.CoCreateInstance From 56cc5cea20662d9b5bb4fa9c88ec69ead16504da Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 25 Jul 2026 21:51:54 +0800 Subject: [PATCH 5/8] Match wordings to comply with existing rules descriptions Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 601d0bd00..2b52c37fd 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -4,6 +4,7 @@ rule: namespace: impact/features authors: - still@teamt5.org + description: Looks for CLSID/IIDs used when making COM calls to the Windows Security Center component; may be to impair Windows Defender by registering itself as a security solution. scopes: static: function dynamic: unsupported # requires bytes features @@ -16,7 +17,6 @@ rule: - https://github.com/Feng-Teng/Microsoft-Defender/ examples: - f5449806ad50242a4df9186455434b5957f3fc2044d85a9f1d9135a542b678cc:0x18000d090 - description: Match CLSID/IIDs used when making COM calls to the Windows Security Center component; may be to impair Windows Defender by registering itself as a security solution. features: - and: - api: ole32.CoCreateInstance From 127745bfe25530e0c993e1ee1faafb8538f5a914 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 25 Jul 2026 21:52:49 +0800 Subject: [PATCH 6/8] Fix awkward language Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 2b52c37fd..f8c61c512 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -4,7 +4,7 @@ rule: namespace: impact/features authors: - still@teamt5.org - description: Looks for CLSID/IIDs used when making COM calls to the Windows Security Center component; may be to impair Windows Defender by registering itself as a security solution. + description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution. scopes: static: function dynamic: unsupported # requires bytes features From b8c5ea7bbdea6c7ef163eacd5b4c54792cf810f6 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Tue, 28 Jul 2026 07:41:58 +0800 Subject: [PATCH 7/8] Fix linting Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index f8c61c512..4962720d9 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -4,7 +4,7 @@ rule: namespace: impact/features authors: - still@teamt5.org - description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution. + description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution. scopes: static: function dynamic: unsupported # requires bytes features From a5e01206c489a15755f01ff30005d467ca636be8 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Tue, 28 Jul 2026 08:11:17 +0800 Subject: [PATCH 8/8] Undo description linting Signed-off-by: Still Hsu --- nursery/register-windows-security-center-product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nursery/register-windows-security-center-product.yml b/nursery/register-windows-security-center-product.yml index 4962720d9..f8c61c512 100644 --- a/nursery/register-windows-security-center-product.yml +++ b/nursery/register-windows-security-center-product.yml @@ -4,7 +4,7 @@ rule: namespace: impact/features authors: - still@teamt5.org - description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution. + description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution. scopes: static: function dynamic: unsupported # requires bytes features