Windows Defender antimalware grace period expired (Event ID 5101, windefend)

title: Windows Defender antimalware grace period expired (Event ID 5101, windefend)
id: b9d951a9-cdec-48a9-a08f-654f68c75030
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: obsolete
  - id: 360a1340-398a-46b6-8d06-99b905dc69d2
    type: derived
status: stable
description: This rule flags Windows Defender reporting that the antimalware platform grace period has expired (Event ID 5101) via the windefend service. When this occurs, protection against viruses, spyware, and other potentially unwanted software is disabled, which can enable attackers to operate with reduced defenses. It relies on Windows security telemetry from the windefend event stream carrying Event ID 5101.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2023-11-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5101
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1