Windows Defender (windefend) Virus Scanning Disabled (Event ID 5012)

title: Windows Defender (windefend) Virus Scanning Disabled (Event ID 5012)
id: 9d0b04b9-e9f1-44c4-8aa0-d25e00199600
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: obsolete
  - id: 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb
    type: derived
status: stable
description: This rule detects Windows Defender disabling the virus scanning feature, indicated by windefend Event ID 5012. Disabling scanning reduces endpoint protection and can enable persistence or follow-on malicious activity without AV inspection. It relies on Windows Defender telemetry from the windefend service reporting the specific event ID.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_virus_scan_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2023-11-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5012
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1