RoguePlanet Vulnerability: Mitigating Microsoft Defender Security Bypass Risks

---
title: RoguePlanet - Suspicious Modification of Defender Registry Keys
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to modify Microsoft Defender registry keys, indicative of a successful Tamper Protection bypass like RoguePlanet.
references:
  - https://www.microsoft.com/security/blog/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'SOFTWARE\\Microsoft\\Windows Defender\\Features'
      - 'SOFTWARE\\Policies\\Microsoft\\Windows Defender'
    Details|contains:
      - 'DisableAntiSpyware'
      - 'DisableAntiVirus'
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableBlockAtFirstSeen'
  condition: selection
falsepositives:
  - Legitimate administrative scripts modifying Defender policies (rare)
level: high
---
title: RoguePlanet - PowerShell Tampering Commands
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell commands attempting to disable Defender features, which are indicative of RoguePlanet exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'Add-MpPreference'
      - 'ExclusionPath'
  condition: all of selection_*
falsepositives:
  - System administrators configuring exclusions manually
level: high
---
title: RoguePlanet - Defender Service Stop Attempts
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects attempts to stop the Microsoft Defender service (WinDefend), a post-exploitation action often seen after RoguePlanet bypass.
references:
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    CommandLine|contains:
      - 'Stop-Service WinDefend'
      - 'sc stop WinDefend'
      - 'net stop WinDefend'
  filter_legit:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'NETWORK SERVICE'
  condition: selection_cli and not filter_legit
falsepositives:
  - Legitimate service management by administrators
level: critical

// Hunt for RoguePlanet: Registry modifications to disable Defender
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"SOFTWARE\Microsoft\Windows Defender"
| extend KeyName = tostring(split(RegistryKey, @"\")[-1])
| where RegistryValueName in ("DisableAntiSpyware", "DisableRealtimeMonitoring", "TamperProtection", "DisableBlockAtFirstSeen")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine
| order by Timestamp desc

// Hunt for RoguePlanet: PowerShell commands disabling protection
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Set-MpPreference" or ProcessCommandLine has "Add-MpPreference"
| extend CommandArgs = extract_all(@"(\S+)", ProcessCommandLine)
| where ProcessCommandLine has_any ("-Disable", "-Exclusion")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for RoguePlanet: Check Defender registry integrity
SELECT 
  timestamp(epoch=Sys.mtime) as MTime,
  FullPath,
  Data.value as Value
FROM read_reg_key(globs=[
  'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\*',
  'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\*'
])
WHERE Name =~ 'Disable'
  AND Data.value =~ 1

-- Hunt for RoguePlanet: Identify processes modifying Defender keys
SELECT 
  Pid, Name, Username, CommandLine, Exe
FROM pslist()
WHERE CommandLine =~ 'Set-MpPreference' 
   OR CommandLine =~ 'Stop-Service'
   OR CommandLine =~ 'WinDefend'

# Remediation Script: Verify and Restore Defender Integrity post-RoguePlanet
# Requires Administrator privileges

Write-Host "[*] Checking Microsoft Defender State..." -ForegroundColor Cyan

# Check Tamper Protection Status
$TamperStatus = Get-MpComputerStatus | Select-Object -ExpandProperty TamperProtectionStatus
if ($TamperStatus -ne "On") {
    Write-Host "[ALERT] Tamper Protection is currently disabled or unknown: $TamperStatus" -ForegroundColor Red
    Write-Host "[ACTION] Re-enabling Tamper Protection via Registry (if required)..."
    # Note: Tamper Protection is best managed via Intune/MEM, but this registry key represents the underlying state
    # forcing a re-check via PowerShell is recommended
} else {
    Write-Host "[OK] Tamper Protection is Enabled." -ForegroundColor Green
}

# Check Real-Time Protection
$Realtime = Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled
if (-not $Realtime) {
    Write-Host "[ALERT] Real-time protection is disabled. Attempting to enable..." -ForegroundColor Red
    Set-MpPreference -DisableRealtimeMonitoring $false -Force
    Write-Host "[INFO] Verifying status..."
    $Verify = Get-MpComputerStatus | Select-Object -ExpandProperty RealTimeProtectionEnabled
    if ($Verify) { Write-Host "[OK] Real-time protection restored." -ForegroundColor Green }
} else {
    Write-Host "[OK] Real-time protection is Enabled." -ForegroundColor Green
}

# Scan for recent suspicious driver loads (Potential RoguePlanet vector)
Write-Host "[*] Checking for recently loaded kernel drivers..." -ForegroundColor Cyan
$Drivers = driverquery.exe /FO CSV | ConvertFrom-Csv | Where-Object { $_."Loaded Module Name" -ne "Module Name" }
$SuspiciousDrivers = $Drivers | Where-Object { $_."Display Name" -match "Rogue|Test|Debug|Unsigned" -or $_.Path -match "Temp" }

if ($SuspiciousDrivers) {
    Write-Host "[ALERT] Found potentially suspicious drivers:" -ForegroundColor Red
    $SuspiciousDrivers | Format-Table
} else {
    Write-Host "[OK] No immediately obvious suspicious drivers detected." -ForegroundColor Green
}

# Check for Defender Exclusions that were added recently
Write-Host "[*] Auditing Defender Exclusions..." -ForegroundColor Cyan
$Exclusions = Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess
if ($Exclusions.ExclusionPath.Count -gt 0 -or $Exclusions.ExclusionExtension.Count -gt 0) {
    Write-Host "[INFO] Current Exclusions configured:" -ForegroundColor Yellow
    $Exclusions | Format-List
    Write-Host "[ACTION] Please review these exclusions manually to ensure they are legitimate." -ForegroundColor Yellow
}

Write-Host "[*] Remediation Check Complete." -ForegroundColor Cyan