Windows Defender Virus Scanning Feature Disabled

Detects disabling of the Windows Defender virus scanning feature

Sigma rule (View on GitHub)

 1title: Windows Defender Virus Scanning Feature Disabled
 2id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb
 3related:
 4    - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
 5      type: obsoletes
 6status: stable
 7description: Detects disabling of the Windows Defender virus scanning feature
 8references:
 9    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
10    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
11    - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
12author: Ján Trenčanský, frack113
13date: 2020/07/28
14modified: 2023/11/22
15tags:
16    - attack.defense_evasion
17    - attack.t1562.001
18logsource:
19    product: windows
20    service: windefend
21detection:
22    selection:
23        EventID: 5012 # Scanning for viruses is disabled.
24    condition: selection
25falsepositives:
26    - Unknown
27level: high

References

Related rules

to-top