
title: Windows Defender Threat Detection Disabled
author: Ján Trenčanský, frack113, AlertIQ
date: 2020/07/28
description: Detects disabling Windows Defender threat protection
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    Details: DWORD (0x00000001)
  SELECTION_5:
    EventType: SetValue
  SELECTION_6:
    TargetObject:
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus
  SELECTION_7:
    TargetObject:
    - HKLM\SYSTEM\CurrentControlSet\Services\WinDefend
    - HKLM\SOFTWARE\Microsoft\Windows Defender
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and ((SELECTION_5
    and SELECTION_6) or SELECTION_7))
falsepositives:
- Administrator actions
id: a64e4198-c1c8-46a5-bc9c-324c86455fd4
level: high
logsource:
  category: registry_event
  product: windows
modified: 2021/10/18
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
related:
- id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
  type: derived
status: experimental
tags:
- attack.defense_evasion
- attack.t1089
- attack.t1562.001
ruletype: SIGMA
