Windows Defender Real-Time Protection Feature Error or Restart (windefend)

title: Windows Defender Real-Time Protection Feature Error or Restart (windefend)
id: 7aadff6d-5128-4233-b49e-0db1e4a01957
status: stable
description: This rule flags Windows Defender Real-Time Protection issues where a feature fails after encountering an error or restarts shortly thereafter. Such events can indicate defense impairment or reliability problems that an attacker may attempt to exploit to reduce endpoint protection effectiveness. It relies on windefend telemetry for EventIDs 3002 (feature error) and 3007 (feature restarted), with an optional filter for the Network Inspection System and related update/INTEL stop reasons.
references:
  - Internal Research
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml
author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update), Huntrule Team
date: 2023-03-28
modified: 2023-05-05
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID:
      - 3002
      - 3007
  filter_optional_network_inspection:
    Feature_Name: "%%886"
    Reason:
      - "%%892"
      - "%%858"
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required
level: medium
license: DRL-1.1
related:
  - id: dd80db93-6ec2-4f4c-a017-ad40da6ffe81
    type: derived