Windows Registry Changes Disabling Windows Defender Event Log Channel

Detects registry changes that disable the Windows Defender Operational event log channel by setting its Enabled DWORD to 0.

FreeUnreviewedSigmahighv1

windows-registry-changes-disabling-windows-defender-event-log-channel-fcddca7c

title: Windows Registry Changes Disabling Windows Defender Event Log Channel
id: 60dd7e87-848c-41db-9f2c-34117611302b
status: test
description: This rule flags registry updates that set the Enabled value to 0 for the Windows Defender Operational event log channel (Microsoft-Windows-Windows Defender/Operational). Disabling security event logging can reduce visibility and hinder incident detection after compromise. It relies on registry_set telemetry capturing writes to the specific WINEVT Channels path and the associated DWORD Enabled value.
references:
  - https://twitter.com/WhichbufferArda/status/1543900539280293889/photo/2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-04
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Other Antivirus software installations could cause Windows to disable that eventlog (unknown)
level: high
license: DRL-1.1
related:
  - id: fcddca7c-b9c0-4ddf-98da-e1e2d18b0157
    type: derived

What it detects

This rule flags registry updates that set the Enabled value to 0 for the Windows Defender Operational event log channel (Microsoft-Windows-Windows Defender/Operational). Disabling security event logging can reduce visibility and hinder incident detection after compromise. It relies on registry_set telemetry capturing writes to the specific WINEVT Channels path and the associated DWORD Enabled value.

Known false positives

Other Antivirus software installations could cause Windows to disable that eventlog (unknown)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.