Windows Defender windefend: Automatic Sample Submission disabled via antimalware configuration change

title: "Windows Defender windefend: Automatic Sample Submission disabled via antimalware configuration change"
id: 8081c5e5-4691-4565-9648-be586e3d213b
related:
  - id: 1321dc4e-a1fe-481d-a016-52c45f0c8b4f
    type: similar
  - id: a3ab73f1-bd46-4319-8f06-4b20d0617886
    type: similar
  - id: 801bd44f-ceed-4eb6-887c-11544633c0aa
    type: similar
  - id: 91903aba-1088-42ee-b680-d6d94fe002b0
    type: derived
status: stable
description: This rule matches windefend event ID 5007 when the new antimalware configuration contains Real-Time Protection\SubmitSamplesConsent = 0x0, indicating Microsoft Defender’s automatic sample submission has been disabled. Attackers may suppress this telemetry to reduce the likelihood that suspicious files are automatically shared for analysis and subsequent detection. It relies on Windows Defender (windefend) configuration-change events and the presence of the specific consent value in the new configuration.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-06
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5007
    NewValue|contains: \Real-Time Protection\SubmitSamplesConsent = 0x0
  condition: selection
falsepositives:
  - Administrator activity (must be investigated)
level: low
license: DRL-1.1