Windows Service Control Manager: Windows Defender Threat Protection Disabled

Flags Service Control Manager events where the Windows Defender Threat Protection (Defender Antivirus) service is stopped.

FreeReviewedSigma · Medium · v2

Product: windows
Service: system
Author: Ján Trenčanský, frack113 (SigmaHQ), DRL 1.1
Published: 2020-07-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies service stop events for the Windows Defender Antivirus/Threat Protection service, as recorded by the Service Control Manager (EventID 7036). Disabling or stopping this security service can reduce defensive coverage and may indicate defense impairment attempts. It relies on Windows system telemetry capturing the service state change message and the affected service name, which can be localized across OS languages.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Windows Defender Exclusion via Add-MpPreference (via process_creation)

Malicious Windows Defender Service Tampering via PowerShell (via process_creation)

Windows Defender Disabled via DisableAntiSpyware Registry Key

Suspicious Vulnerable Intel Ethernet Driver Load for BYOVD via SCATTERED SPIDER (via driver_load)

Malicious Defender Disable And Executable Exclusion Via Registry

Malicious UAC Disable via EnableLUA Registry Modification (via registry_set)

Malicious AMSI and ETW Patching via PowerShell Script

Malicious PowMix AMSI Bypass via amsiInitFailed

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

Windows Service Control Manager: Windows Defender Threat Protection Disabled

Pivot detection · T1685 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-control-manager-windows-defender-threat-protection-service-stopp-6c0a7755

title: "Windows Service Control Manager: Windows Defender Threat Protection Disabled"
id: 9938e8b2-ef68-4cda-b1e9-8610cea21b03
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: derived
  - id: 6c0a7755-6d31-44fa-80e1-133e57752680
    type: derived
status: stable
description: This rule identifies service stop events for the Windows Defender Antivirus/Threat Protection service, as recorded by the Service Control Manager (EventID 7036). Disabling or stopping this security service can reduce defensive coverage and may indicate defense impairment attempts. It relies on Windows system telemetry capturing the service state change message and the affected service name, which can be localized across OS languages.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2024-07-02
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7036
    Provider_Name: Service Control Manager
    param1:
      - Windows Defender Antivirus Service
      - Service antivirus Microsoft Defender
    param2:
      - stopped
      - arrêté
  condition: selection
falsepositives:
  - Administrator actions
  - Auto updates of Windows Defender causes restarts
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL