Windows Defender Virus Scanning Feature Disabled

 1title: Windows Defender Virus Scanning Feature Disabled
 2id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb
 3related:
 4    - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
 5      type: obsolete
 6status: stable
 7description: Detects disabling of the Windows Defender virus scanning feature
 8references:
 9    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
10    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
11    - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
12author: Ján Trenčanský, frack113
13date: 2020-07-28
14modified: 2023-11-22
15tags:
16    - attack.defense-evasion
17    - attack.t1562.001
18logsource:
19    product: windows
20    service: windefend
21detection:
22    selection:
23        EventID: 5012 # Scanning for viruses is disabled.
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

• Microsoft Defender Antivirus event IDs and error codes - Microsoft Defender for Endpoint

  

  Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors.

  
  Read More

• atomic-red-team/atomics/T1562.001/T1562.001.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Hunting Malicious Windows Defender Activity

  

  Recently I was demo-ing Azure Sentinel to a large organization, and someone asked me “what if an attacker manages to compromise my system and disabled Windows Defender” Well…what if the…

  
  Read More

Related rules

• AMSI Bypass Pattern Assembly GetType
• AWS CloudTrail Important Change
• AWS Config Disabling Channel/Recorder
• AWS GuardDuty Important Change
• Add SafeBoot Keys Via Reg Utility