Microsoft Defender Tamper Protection Trigger — Sigma Rule

Rule metadata and linked tags

Author: Bhabesh Raj, Nasreddine Bencherchali. Source status: stable; severity: high. Source dates: 2021-07-05 / 2022-12-06.

{
  "product": "windows",
  "service": "windefend"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 987eb5b817ed9157645644b538f201dce266a98a04cb0eab471b98e6334d6ff9

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Microsoft Defender Tamper Protection Trigger
id: 49e5bc24-8b86-49f1-b743-535f332c2856
status: stable
description: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
references:
    - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
author: Bhabesh Raj, Nasreddine Bencherchali
date: 2021-07-05
modified: 2022-12-06
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    service: windefend
detection:
    selection:
        EventID: 5013 # Tamper protection blocked a change to Microsoft Defender Antivirus. If Tamper protection is enabled then, any attempt to change any of Defender's settings is blocked. Event ID 5013 is generated and states which setting change was blocked.
        Value|endswith:
            - '\Windows Defender\DisableAntiSpyware'
            - '\Windows Defender\DisableAntiVirus'
            - '\Windows Defender\Scan\DisableArchiveScanning'
            - '\Windows Defender\Scan\DisableScanningNetworkFiles'
            - '\Real-Time Protection\DisableRealtimeMonitoring'
            - '\Real-Time Protection\DisableBehaviorMonitoring'
            - '\Real-Time Protection\DisableIOAVProtection'
            - '\Real-Time Protection\DisableScriptScanning'
    condition: selection
falsepositives:
    - Administrator might try to disable defender features during testing (must be investigated)
level: high

Original YAML and metadata in JSON

False positives

• Administrator might try to disable defender features during testing (must be investigated)

Source references

• https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
• https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide