{"id":"801bd44f-ceed-4eb6-887c-11544633c0aa","title":"Windows Defender Configuration Changes","description":"Detects suspicious changes to the Windows Defender configuration","author":"Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"high","date":"2022-12-06","modified":"2023-11-24","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","service":"windefend"},"falsepositives":["Administrator activity (must be investigated)"],"references":["https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide","https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware"],"source_path":"rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml","source_sha256":"fffa0b02005cee99d6ddbe9367a5428aecbce2133b65524e9aae70e30b004b83","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Defender Configuration Changes\nid: 801bd44f-ceed-4eb6-887c-11544633c0aa\nrelated:\n    - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f\n      type: similar\n    - id: a3ab73f1-bd46-4319-8f06-4b20d0617886\n      type: similar\n    - id: 91903aba-1088-42ee-b680-d6d94fe002b0\n      type: similar\nstatus: stable\ndescription: Detects suspicious changes to the Windows Defender configuration\nreferences:\n    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide\n    - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-06\nmodified: 2023-11-24\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    service: windefend\ndetection:\n    selection:\n        EventID: 5007 # The antimalware platform configuration changed.\n        NewValue|contains:\n            # TODO: Add more suspicious values\n            - '\\Windows Defender\\DisableAntiSpyware '\n            # - '\\Windows Defender\\Features\\TamperProtection ' # Might produce FP\n            - '\\Windows Defender\\Scan\\DisableRemovableDriveScanning '\n            - '\\Windows Defender\\Scan\\DisableScanningMappedNetworkDrivesForFullScan '\n            - '\\Windows Defender\\SpyNet\\DisableBlockAtFirstSeen '\n            - '\\Real-Time Protection\\SpyNetReporting '\n            # Exclusions changes are covered in 1321dc4e-a1fe-481d-a016-52c45f0c8b4f\n            # Exploit guard changes are covered in a3ab73f1-bd46-4319-8f06-4b20d0617886\n    condition: selection\nfalsepositives:\n    - Administrator activity (must be investigated)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/801bd44f-ceed-4eb6-887c-11544633c0aa.json","kind":"sigma"}