Windows Defender Real-time Protection Disabled

Attackers often target security controls to facilitate the execution of malicious payloads, persistence mechanisms, or data exfiltration. Disabling Windows Defender real-time protection (Event ID 5001) is a common defense evasion technique used by adversaries to prevent detection of malware during the post-exploitation phase. This activity is logged by the Windows Defender service and, while it can occasionally be triggered by legitimate administrative activity or automated system updates, it is highly suspicious when occurring in the absence of documented change management. Security teams should monitor for this event to identify unauthorized attempts to weaken host-based defenses.

Impact

Successful disabling of real-time protection significantly increases the risk of malware infection, unauthorized binary execution, and persistent foothold establishment within the affected host. If left unmonitored, this behavior provides attackers with a window of opportunity to operate undetected.

Recommendation

• Deploy the Sigma rule below to monitor for Windows Defender service modifications.
• Correlate Event ID 5001 occurrences with other process execution logs (Event ID 4688) to determine if a privileged user or suspicious process initiated the change.
• Audit change management logs for legitimate maintenance windows that might coincide with this event to reduce noise.