Skip to content
Threat Feed
Subscribe
low advisory

Windows Defender: Automatic sample submission feature disabled

Detection of the disabling of the "Automatic Sample Submission" feature of Windows Defender.

Triage facts

Revision 1
Evidence
Unknown
Severity
Low
Sources
3 public sources
Freshness
Revision 1Nov 10, 02:42 UTC
Detection
1 rule
Source quality
A2Roughly even chance

The "Automatic Sample Submission" feature of Windows Defender can be disabled, which modifies the antimalware platform configuration. This event is logged via Event ID 5007.

Recommendation

  • Monitor Windows event logs for Event ID 5007.
  • Investigate occurrences of this configuration change, as they may result from administrator activity.

Detection coverage 1

Detect Windows Defender Automatic Sample Submission Disabled

low

Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

sigma tactics: defense-impairment sources: windows, windefend

Detection queries are available on the platform. Get full rules →