Detection of Unauthorized Windows Defender Configuration Changes

hello@craftedsignal.io — Tue, 01 Sep 2026 13:09:41 +0000

Attackers often target Windows Defender Antivirus configuration settings to impair host-based security controls. By modifying specific registry keys, adversaries can disable real-time protection, bypass signature-based detection, or exclude malicious directories from scans. This activity is commonly observed during the defense evasion stage of an attack, often performed via PowerShell scripts or direct registry modifications. Monitoring Windows Defender operational logs is critical for defenders to identify unauthorized modifications that deviate from baseline organizational policy. Defenders should focus on Event ID 5007 within the Windows Defender service logs, which records changes to antimalware platform configurations, to identify potential tampering attempts.

Impact

Successful modification of Windows Defender configuration leads to the disabling of essential security features, leaving the host vulnerable to malware execution, credential theft, and persistent unauthorized access. This allows adversaries to maintain a foothold on the target system while evading automated security analysis and behavioral detection mechanisms.

Recommendation

Deploy the provided Sigma rule to monitor Windows Defender event logs for configuration tampering.
Enable Sysmon or Windows Event Log collection for Event ID 5007 on all critical endpoints.
Investigate any alerts generated by this rule, as legitimate administrative changes should be documented and authorized through a change management process.

Detection of Windows Defender Real-time Protection Impairment

hello@craftedsignal.io — Tue, 01 Sep 2026 12:07:48 +0000

Adversaries often attempt to disable security software to facilitate the deployment of malware, ransomware, or persistence mechanisms without triggering heuristic or signature-based alerts. Disabling Windows Defender specifically allows attackers to move laterally, execute malicious payloads, or establish command-and-control communication with reduced risk of detection. Monitoring for the deactivation of antivirus features is a critical component of a robust defense-in-depth strategy. This brief focuses on detecting Microsoft-Windows-Windows Defender Event ID 5012, which indicates that the scanning engine has been turned off. This event is typically generated following administrative actions or malicious modifications to Windows registry keys and security settings. Detection engineers should ensure that these events are forwarded to their security information and event management (SIEM) systems to alert on unauthorized changes to anti-malware configurations.

Impact

Successful impairment of Windows Defender significantly lowers the security posture of an endpoint, rendering the system vulnerable to a wide range of exploits and malicious payloads that would otherwise be blocked. If the feature is disabled, attackers can perform post-exploitation activities, including credential dumping, persistence installation, and data exfiltration, with a much higher probability of evading detection. This technique is frequently observed across various campaigns targeting Windows environments to ensure persistent access and stealthy execution.

Recommendation

Enable collection of Microsoft-Windows-Windows Defender/Operational logs in all Windows endpoints.
Implement the provided Sigma rule to alert on Event ID 5012, which signifies a high-severity security configuration change.
Investigate the source of any Event ID 5012 to determine if it resulted from authorized system administration or unauthorized malicious activity.
Establish a baseline of authorized software deployment and maintenance activities to tune out expected occurrences of antivirus service configuration changes.

Security-Telemetry - CraftedSignal Threat Feed

Detection of Unauthorized Windows Defender Configuration Changes

Impact

Recommendation

Detection of Windows Defender Real-time Protection Impairment

Impact

Recommendation