Windows Service Control Manager: Windows Defender Threat Protection service stopped

Flags Service Control Manager events where the Windows Defender Threat Protection (Defender Antivirus) service is stopped.

FreeUnreviewedSigmamediumv1

windows-service-control-manager-windows-defender-threat-protection-service-stopp-6c0a7755

title: "Windows Service Control Manager: Windows Defender Threat Protection service stopped"
id: 9938e8b2-ef68-4cda-b1e9-8610cea21b03
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: derived
  - id: 6c0a7755-6d31-44fa-80e1-133e57752680
    type: derived
status: stable
description: This rule identifies when the Windows Defender Antivirus service (Windows Defender Threat Protection) is stopped, based on Service Control Manager event messages. Attackers may disable or stop security services to impair endpoint protections and reduce detection coverage. It relies on Windows system telemetry from Service Control Manager, specifically Event ID 7036 and the localized service name/state text captured in event parameters.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2024-07-02
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7036
    Provider_Name: Service Control Manager
    param1:
      - Windows Defender Antivirus Service
      - Service antivirus Microsoft Defender
    param2:
      - stopped
      - arrêté
  condition: selection
falsepositives:
  - Administrator actions
  - Auto updates of Windows Defender causes restarts
level: medium
license: DRL-1.1

What it detects

This rule identifies when the Windows Defender Antivirus service (Windows Defender Threat Protection) is stopped, based on Service Control Manager event messages. Attackers may disable or stop security services to impair endpoint protections and reduce detection coverage. It relies on Windows system telemetry from Service Control Manager, specifically Event ID 7036 and the localized service name/state text captured in event parameters.

Known false positives

Administrator actions
Auto updates of Windows Defender causes restarts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.