Windows Defender Real-time Protection Disabled

calendar Dec 21, 2023 · attack.defense_evasion attack.t1562.001  ·
Share on: linkedin copy

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initaited this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Sigma rule (View on GitHub)

 1title: Windows Defender Real-time Protection Disabled
 2id: b28e58e4-2a72-4fae-bdee-0fbe904db642
 3related:
 4    - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
 5      type: obsoletes
 6status: stable
 7description: |
 8        Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initaited this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
 9references:
10    - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
11    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
12    - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
13author: Ján Trenčanský, frack113
14date: 2020/07/28
15modified: 2023/11/22
16tags:
17    - attack.defense_evasion
18    - attack.t1562.001
19logsource:
20    product: windows
21    service: windefend
22detection:
23    selection:
24        EventID: 5001 # Real-time protection is disabled.
25    condition: selection
26falsepositives:
27    - Administrator actions (should be investigated)
28    - Seen being triggered occasionally during Windows 8 Defender Updates
29level: high

References

Related rules

to-top