Windows Defender Malware And PUA Scanning Disabled
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Sigma rule (View on GitHub)
1title: Windows Defender Malware And PUA Scanning Disabled
2id: bc275be9-0bec-4d77-8c8f-281a2df6710f
3related:
4 - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
5 type: obsoletes
6status: stable
7description: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
8references:
9 - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
10 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
11 - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
12author: Ján Trenčanský, frack113
13date: 2020/07/28
14modified: 2023/11/22
15tags:
16 - attack.defense_evasion
17 - attack.t1562.001
18logsource:
19 product: windows
20 service: windefend
21detection:
22 selection:
23 EventID: 5010 # Scanning for malware and other potentially unwanted software is disabled.
24 condition: selection
25falsepositives:
26 - Unknown
27level: high
References
-
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
Recently I was demo-ing Azure Sentinel to a large organization, and someone asked me “what if an attacker manages to compromise my system and disabled Windows Defender” Well…what if the…
Read More
Related rules
- Windows Defender Configuration Changes
- Windows Defender Exclusions Added
- Windows Defender Exploit Guard Tamper
- Windows Defender Grace Period Expired
- Windows Defender Real-time Protection Disabled