
title: Windows Defender Real-Time Protection Disabled
author: AlertIQ
date: 2021/10/18
description: Detects disabling Windows Defender Real-Time Protection by modifying
  registry
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    EventType: SetValue
  SELECTION_5:
    TargetObject:
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet\DisableBlockAtFirstSeen
  SELECTION_6:
    Details: DWORD (0x00000001)
  SELECTION_7:
    TargetObject:
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet\SpynetReporting
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent
  SELECTION_8:
    Details: DWORD (0x00000000)
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and ((SELECTION_5
    and SELECTION_6) or (SELECTION_7 and SELECTION_8)))
falsepositives:
- Administrator actions
id: fd115e64-97c7-491f-951c-fc8da7e042fa
level: high
logsource:
  category: registry_event
  product: windows
references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105
status: experimental
tags:
- attack.defense_evasion
- attack.t1562.001
ruletype: SIGMA
