Fake Software Installer Campaign Disables Windows Update and Weakens Microsoft Defender — Detection and Remediation Guide

---
title: Windows Update Service Disabled via Command Line
id: 3f9c2a71-6e4b-4d58-9a21-7c1e5b8d2f04
status: experimental
description: Detects attempts to stop or disable the Windows Update service (wuauserv) or related update services, consistent with fake installer campaigns that halt patching to maintain an unpatchable foothold.
references:
  - https://thehackernews.com/2026/09/fake-software-installers-disable.html
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
    CommandLine|contains:
      - 'wuauserv'
      - 'UsoSvc'
      - 'WaaSMedicSvc'
  selection_sc_action:
    CommandLine|contains:
      - 'stop'
      - 'disabled'
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'stop wuauserv'
      - 'stop usosvc'
  condition: (selection_sc and selection_sc_action) or selection_net
falsepositives:
  - Legitimate system administration scripts managing update windows; baseline and allowlist known admin tooling
level: high
---
title: Microsoft Defender Real-Time Protection Disabled or Exclusion Added
id: 8b41d6c3-2f7a-4e95-bc38-9d0a4e6f1c27
status: experimental
description: Detects command-line attempts to disable Defender real-time monitoring or add path/process exclusions, a hallmark of trojanized installers weakening endpoint protection before staging payloads.
references:
  - https://thehackernews.com/2026/09/fake-software-installers-disable.html
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'Add-MpPreference'
  selection_action:
    CommandLine|contains:
      - '-DisableRealtimeMonitoring'
      - '-DisableBehaviorMonitoring'
      - '-DisableIOAVProtection'
      - '-DisableScriptScanning'
      - '-ExclusionPath'
      - '-ExclusionProcess'
      - '-ExclusionExtension'
  condition: selection_cmd and selection_action
falsepositives:
  - Legitimate IT exclusions for build directories or approved developer tooling; validate against change records and restrict to authorized admin accounts
level: high
---
title: Registry Policy Tampering with Windows Update or Windows Defender
id: c57e0f29-1a3d-4b68-8f42-5b7d9e2a6c81
status: experimental
description: Detects registry writes to policy keys that disable Windows Update auto-patching or Microsoft Defender anti-spyware, matching the defense-impairment stage of the fake installer campaign.
references:
  - https://thehackernews.com/2026/09/fake-software-installers-disable.html
  - https://attack.mitre.org/techniques/T1112/
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1112
  - attack.t1562.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_wu:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
    Details|contains:
      - 'NoAutoUpdate'
  selection_defender:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows Defender'
    Details|contains:
      - 'DisableAntiSpyware'
      - 'DisableAntiVirus'
  condition: selection_wu or selection_defender
falsepositives:
  - Domain GPO deployment of update policies will appear here if the registry provider captures it; correlate with GPO change windows and exclude known management tooling (e.g., ConfigMgr, Intune)
level: high

// Hunt: Windows Update or Defender tampering from installer-adjacent processes
let TamperCmds = dynamic([
    "stop wuauserv", "wuauserv", "usosvc",
    "Set-MpPreference", "Add-MpPreference",
    "DisableRealtimeMonitoring", "ExclusionPath",
    "DisableAntiSpyware", "NoAutoUpdate"
]);
let Suspicious =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any (TamperCmds)
    | where not(InitiatingProcessAccountName has_any ("system", "trustedinstaller")
        and FolderPath has_any ("configmgr", "intune", "admin$"))
    | project TamperTime=TimeGenerated, DeviceName, AccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName,
              InitiatingProcessCommandLine, SHA256, DeviceId;
let DefenderDegraded =
    DeviceEvents
    | where TimeGenerated > ago(14d)
    | where ActionType has_any ("AntivirusSignatureVersionUpdated", "AntivirusTampering")
       or AdditionalFields has "IsTamperProtected\":\"false"
    | project DegradeTime=TimeGenerated, DeviceName, ActionType, AdditionalFields, DeviceId;
Suspicious
| join kind=leftouter DefenderDegraded on DeviceId
| where isnull(DegradeTime) or DegradeTime between (TamperTime .. TamperTime + 4h)
| project TamperTime, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ActionType
| order by TamperTime desc

// Service state changes for update services from Security/System event ingestion
union withsource=SourceTable SecurityEvent, Event
| where TimeGenerated > ago(14d)
| extend CommandLine = coalesce(CommandLine, tostring(EventData))
| where CommandLine has_any ("wuauserv", "UsoSvc", "WaaSMedicSvc")
   and CommandLine has_any ("stop", "disabled", "demand")
| project TimeGenerated, SourceTable, Computer, Account, CommandLine, EventID
| order by TimeGenerated desc

-- Hunt: Windows Update / Defender tampering artifacts
-- Checks service config, policy registry keys, and running process command lines
SELECT * FROM foreach(
  row={ SELECT Name, Pid, CommandLine, Exe, Username FROM pslist() },
  query={
    SELECT Name AS ProcName, Pid, CommandLine, Exe, Username,
           'process' AS Source
    FROM scope()
    WHERE CommandLine =~ '(?i)(wuauserv|usosvc|Set-MpPreference|Add-MpPreference|DisableRealtimeMonitoring|ExclusionPath|DisableAntiSpyware)'
})

-- Hunt: Windows Update and Defender policy registry state across the fleet
SELECT FullPath, Name,
       Data.value AS ValueData,
       Mtime AS LastModified
FROM glob(
  globs=[
    'HKLM/SOFTWARE/Policies/Microsoft/Windows/WindowsUpdate/AU/*',
    'HKLM/SOFTWARE/Policies/Microsoft/Windows Defender/*',
    'HKLM/SYSTEM/CurrentControlSet/Services/wuauserv/*',
    'HKLM/SYSTEM/CurrentControlSet/Services/WinDefend/*'
  ],
  accessor='registry'
)
WHERE Name =~ '(?i)(NoAutoUpdate|DisableAntiSpyware|DisableAntiVirus|Start|DisableRealtimeMonitoring)'

#Requires -RunAsAdministrator
# Security Arsenal - Fake Installer Defense-Impairment Audit & Remediation
# Run elevated. Outputs a per-check status and remediates common tampering.

$report = @()
function Add-Finding($Check, $Status, $Detail) {
    $script:report += [pscustomobject]@{ Check=$Check; Status=$Status; Detail=$Detail }
}

# 1. Windows Update service state
$wu = Get-Service -Name wuauserv -ErrorAction SilentlyContinue
if ($wu -and $wu.StartType -eq 'Disabled') {
    Set-Service -Name wuauserv -StartupType Manual
    Start-Service wuauserv -ErrorAction SilentlyContinue
    Add-Finding 'wuauserv' 'REMEDIATED' 'Service was Disabled; restored to Manual and started'
} else {
    Add-Finding 'wuauserv' 'OK' "StartType=$($wu.StartType) Status=$($wu.Status)"
}

# 2. Windows Update policy registry tampering
$auPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
if (Test-Path $auPath) {
    $noAuto = (Get-ItemProperty -Path $auPath -Name NoAutoUpdate -ErrorAction SilentlyContinue).NoAutoUpdate
    if ($noAuto -eq 1) {
        # Only remove if NOT set by sanctioned GPO - verify against your baseline first
        Remove-ItemProperty -Path $auPath -Name NoAutoUpdate -ErrorAction SilentlyContinue
        Add-Finding 'NoAutoUpdate' 'REMEDIATED' 'NoAutoUpdate=1 found and removed (verify GPO baseline)'
    } else { Add-Finding 'NoAutoUpdate' 'OK' 'Not set or 0' }
} else { Add-Finding 'NoAutoUpdate' 'OK' 'AU policy key not present' }

# 3. Defender DisableAntiSpyware / DisableAntiVirus policy values
$wdPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
foreach ($val in 'DisableAntiSpyware','DisableAntiVirus') {
    $v = (Get-ItemProperty -Path $wdPath -Name $val -ErrorAction SilentlyContinue).$val
    if ($v -eq 1) {
        Remove-ItemProperty -Path $wdPath -Name $val -ErrorAction SilentlyContinue
        Add-Finding $val 'REMEDIATED' "$val=1 found and removed"
    } else { Add-Finding $val 'OK' 'Not set or 0' }
}

# 4. Defender feature status
$mp = Get-MpComputerStatus
if (-not $mp.RealTimeProtectionEnabled) {
    Set-MpPreference -DisableRealtimeMonitoring $false -ErrorAction SilentlyContinue
    Add-Finding 'RealTimeProtection' 'ATTEMPTED_FIX' 'RTP was off; re-enable attempted (Tamper Protection/GPO may block)'
} else { Add-Finding 'RealTimeProtection' 'OK' 'Enabled' }
Add-Finding 'TamperProtection' ($(if ($mp.IsTamperProtected) {'OK'} else {'WARNING'})) "IsTamperProtected=$($mp.IsTamperProtected)"

# 5. Suspicious Defender exclusions (review manually before removing)
$excl = (Get-MpPreference).ExclusionPath
if ($excl) {
    Add-Finding 'ExclusionPath' 'REVIEW' ($excl -join '; ')
} else { Add-Finding 'ExclusionPath' 'OK' 'None configured' }

# 6. Hosts-file / firewall blocks against update endpoints
$hosts = Get-Content "$env:SystemRoot\System32\drivers\etc\hosts" -ErrorAction SilentlyContinue
$badHosts = $hosts | Where-Object { $_ -match '(?i)(windowsupdate|update\.microsoft|download\.windowsupdate)' }
if ($badHosts) { Add-Finding 'HostsFile' 'REVIEW' ($badHosts -join ' | ') } else { Add-Finding 'HostsFile' 'OK' 'No update-endpoint entries' }

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\defense_posture_audit.csv" -NoTypeInformation