Huntress Details Reused Ransomware Playbook That Disables Microsoft Defender

Summary

Huntress describes a ransomware intrusion using a modified script based on a 2021 playbook to disable Microsoft Defender and impair monitoring. Its SOC intervened before file encryption.

Key points

The observed actor entered via RDP, tampered with defenses, removed volume shadow copies, and moved laterally toward a domain controller.
Huntress traced the script to a public GitHub Gist and a playbook documented in a 2021 XingLocker case.
The script disables Defender protections and scheduled tasks, removes visible UI features, and turns off Defender-related WMI logging.
Newer additions include setting Defender threat responses to Allow, changing the network profile to Private, and targeting Defender for Endpoint and boot-time protections.
Huntress says its SOC detected the activity and intervened before the intended ransomware execution encrypted files.
The article recommends detecting behaviors—such as registry changes to security services and PowerShell changes to Defender policies—rather than relying on script hashes or filenames.

Article Details

Attack Vectors: The threat actor entered the network via RDP.
The actor used registry edits and PowerShell commands to disable or weaken Microsoft Defender protections, services, logging, and scheduled tasks.
The actor used WMI to remove volume shadow copies, then moved laterally to the domain controller.
The playbook changed the active network profile to Private to relax firewall rules and facilitate network discovery and file sharing.
The actor intended to execute C:\Temp\file.exe with ransomware-style arguments; Huntress intervened before file encryption.
Defensive Notes: Detect behavior rather than relying on script hashes or filenames, including reg.exe changes to security-service Start values and PowerShell changes to Defender policies.
Monitor for Defender WMI autologgers being disabled, Defender scheduled tasks being disabled, and Defender services being stopped, deleted, or disabled.
Alert on Set-MpPreference settings that allow or take no action on detected threats, and on changes that disable real-time, behavior, archive, or script scanning.
Monitor for changes to the active network profile, ELAM boot configuration, and security-related services or drivers.
Treat removal of Defender context-menu entries and suppression of Defender notifications as suspicious behavior.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//gist[.]github[.]com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2`	Specific GitHub Gist identified as the public origin of the adversarial Defender-disabling script reused in attacks.