Windows Defender Malware And PUA Scanning Disabled

Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

Sigma rule (View on GitHub)

 1title: Windows Defender Malware And PUA Scanning Disabled
 2id: bc275be9-0bec-4d77-8c8f-281a2df6710f
 3related:
 4    - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
 5      type: obsolete
 6status: stable
 7description: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
 8references:
 9    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
10    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
11    - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
12author: Ján Trenčanský, frack113
13date: 2020-07-28
14modified: 2023-11-22
15tags:
16    - attack.defense-evasion
17    - attack.t1562.001
18logsource:
19    product: windows
20    service: windefend
21detection:
22    selection:
23        EventID: 5010 # Scanning for malware and other potentially unwanted software is disabled.
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

Related rules

to-top