{"id":"dd80db93-6ec2-4f4c-a017-ad40da6ffe81","title":"Windows Defender Real-Time Protection Failure/Restart","description":"Detects issues with Windows Defender Real-Time Protection features","author":"Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)","status":"stable","level":"medium","date":"2023-03-28","modified":"2023-05-05","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","service":"windefend"},"falsepositives":["Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required"],"references":["Internal Research","https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/","https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346"],"source_path":"rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml","source_sha256":"4f31c5f6464835306ebea9929083e9334dc80e4b243d4ce007e3bf55c4e1348b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Defender Real-Time Protection Failure/Restart\nid: dd80db93-6ec2-4f4c-a017-ad40da6ffe81\nstatus: stable\ndescription: Detects issues with Windows Defender Real-Time Protection features\nreferences:\n    - Internal Research\n    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/\n    - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346 # Contains the list of Feature Names (use for filtering purposes)\nauthor: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)\ndate: 2023-03-28\nmodified: 2023-05-05\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    service: windefend\ndetection:\n    selection:\n        EventID:\n            - 3002 # Real-Time Protection feature has encountered an error and failed\n            - 3007 # Real-time Protection feature has restarted\n    filter_optional_network_inspection:\n        Feature_Name: '%%886' # Network Inspection System\n        Reason:\n            - '%%892' # The system is missing updates that are required for running Network Inspection System.  Install the required updates and restart the device.\n            - '%%858' # Antimalware security intelligence has stopped functioning for an unknown reason. In some instances, restarting the service may resolve the problem.\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/dd80db93-6ec2-4f4c-a017-ad40da6ffe81.json","kind":"sigma"}