Windows Defender Real-Time Protection Error or Restart (windefend Event 3002/3007)
Alerts on windefend events showing Defender Real-Time Protection feature errors (3002) or restarts (3007).
- Product
- windows
- Service
- windefend
- Author
- Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update) (SigmaHQ), DRL 1.1
- Published
- 2023-03-28
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Defender Real-Time Protection problems by matching windefend events where a feature fails (EventID 3002) or restarts (EventID 3007). Attackers may trigger or take advantage of defensive instability to impair protection, making these events important for validating endpoint security health. It relies on Windows Defender windefend telemetry for the specific event IDs and optionally filters known Network Inspection System update and service-stop reasons.
Reporting behind it
- Internal ResearchInternal Research
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- gist.github.comhttps://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Defender Real-Time Protection Error or Restart (windefend Event 3002/3007)
id: 7aadff6d-5128-4233-b49e-0db1e4a01957
status: stable
description: This rule identifies Windows Defender Real-Time Protection problems by matching windefend events where a feature fails (EventID 3002) or restarts (EventID 3007). Attackers may trigger or take advantage of defensive instability to impair protection, making these events important for validating endpoint security health. It relies on Windows Defender windefend telemetry for the specific event IDs and optionally filters known Network Inspection System update and service-stop reasons.
references:
- Internal Research
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml
author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update), Huntrule Team
date: 2023-03-28
modified: 2023-05-05
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
service: windefend
detection:
selection:
EventID:
- 3002
- 3007
filter_optional_network_inspection:
Feature_Name: "%%886"
Reason:
- "%%892"
- "%%858"
condition: selection and not 1 of filter_optional_*
falsepositives:
- Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required
level: medium
license: DRL-1.1
related:
- id: dd80db93-6ec2-4f4c-a017-ad40da6ffe81
type: derived