Detection of Unauthorized Windows Defender Configuration Changes

Attackers often target Windows Defender Antivirus configuration settings to impair host-based security controls. By modifying specific registry keys, adversaries can disable real-time protection, bypass signature-based detection, or exclude malicious directories from scans. This activity is commonly observed during the defense evasion stage of an attack, often performed via PowerShell scripts or direct registry modifications. Monitoring Windows Defender operational logs is critical for defenders to identify unauthorized modifications that deviate from baseline organizational policy. Defenders should focus on Event ID 5007 within the Windows Defender service logs, which records changes to antimalware platform configurations, to identify potential tampering attempts.

Impact

Successful modification of Windows Defender configuration leads to the disabling of essential security features, leaving the host vulnerable to malware execution, credential theft, and persistent unauthorized access. This allows adversaries to maintain a foothold on the target system while evading automated security analysis and behavioral detection mechanisms.

Recommendation

• Deploy the provided Sigma rule to monitor Windows Defender event logs for configuration tampering.
• Enable Sysmon or Windows Event Log collection for Event ID 5007 on all critical endpoints.
• Investigate any alerts generated by this rule, as legitimate administrative changes should be documented and authorized through a change management process.