Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Read More

Detects Access to LSASS Process

Read More

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

Read More

Detects blocking of process creations originating from PSExec and WMI commands

Read More

Detects the restoration of files from the defender quarantine

Read More

Detects triggering of AMSI by Windows Defender.

Read More

Detects suspicious changes to the Windows Defender configuration

Read More

Detects the Setting of Windows Defender Exclusions

Read More

Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"

Read More

Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.

Read More

Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

Read More

Windows Defender logs when the history of detected infections is deleted.

Read More

Detects issues with Windows Defender Real-Time Protection features

Read More

Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

Read More

Detects actions taken by Windows Defender malware detection engines

Read More

Detects disabling of the Windows Defender virus scanning feature

Read More