Windows Defender Malware and PUA Scanning Disabled (Event ID 5010)

title: Windows Defender Malware and PUA Scanning Disabled (Event ID 5010)
id: 2e714739-a9d9-4504-a304-18433129be03
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: obsolete
  - id: bc275be9-0bec-4d77-8c8f-281a2df6710f
    type: derived
status: stable
description: This rule identifies when Windows Defender scanning for malware and other potentially unwanted software is disabled, based on Windefend event ID 5010. Attackers may disable Defender scanning to reduce detection and increase the chance that malicious or unwanted software remains on the host. Telemetry relies on Windows Defender (Windefend) events carrying event ID 5010.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2023-11-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5010
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1