Windows Defender Configuration Change Alerts via Microsoft Defender (WinDefend) Event 5007

title: Windows Defender Configuration Change Alerts via Microsoft Defender (WinDefend) Event 5007
id: 4998591c-51b8-4af4-a36d-6726b22eb8a3
related:
  - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f
    type: similar
  - id: a3ab73f1-bd46-4319-8f06-4b20d0617886
    type: similar
  - id: 91903aba-1088-42ee-b680-d6d94fe002b0
    type: similar
  - id: 801bd44f-ceed-4eb6-887c-11544633c0aa
    type: derived
status: stable
description: This rule flags Windows event 5007 where the antimalware platform configuration is changed to values consistent with disabling or weakening Microsoft Defender features. Attackers may attempt to reduce detection and monitoring by turning off components such as anti-spyware, scanning, or SpyNet reporting. The detection relies on windefend telemetry for EventID 5007 and matches specific strings in the reported new configuration value.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-06
modified: 2023-11-24
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5007
    NewValue|contains:
      - "\\Windows Defender\\DisableAntiSpyware "
      - "\\Windows Defender\\Scan\\DisableRemovableDriveScanning "
      - "\\Windows Defender\\Scan\\DisableScanningMappedNetworkDrivesForFullScan "
      - "\\Windows Defender\\SpyNet\\DisableBlockAtFirstSeen "
      - "\\Real-Time Protection\\SpyNetReporting "
  condition: selection
falsepositives:
  - Administrator activity (must be investigated)
level: high
license: DRL-1.1