Windows Registry: Tamper Protection Disabled in Microsoft Defender Features

title: "Windows Registry: Tamper Protection Disabled in Microsoft Defender Features"
id: 7452d17f-fd48-4069-94d0-a5016a6dd861
status: test
description: This rule identifies changes to the registry value controlling Microsoft Defender Tamper Protection by matching the TamperProtection feature key and a DWORD value of 0x00000000. Disabling Tamper Protection can weaken host protections and may allow malicious security settings to persist or be modified. The detection relies on registry-set telemetry capturing the targeted key path and the associated DWORD value, with exclusions for MsMpEng.exe scenarios that occur during updates.
references:
  - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-04
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows Defender\Features\TamperProtection
    Details: DWORD (0x00000000)
  filter_msmpeng_client:
    Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith: \MsMpEng.exe
  filter_msmpeng_domain_controller:
    Image: C:\Program Files\Windows Defender\MsMpEng.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 93d298a1-d28f-47f1-a468-d971e7796679
    type: derived