Windows: Windefend Tamper Protection blocked Microsoft Defender setting changes

title: "Windows: Windefend Tamper Protection blocked Microsoft Defender setting changes"
id: 6f99902e-5f71-48d2-9929-9392dd67a817
status: stable
description: This rule identifies windefend events where Microsoft Defender tamper protection blocks attempts to change Defender Antivirus, real-time, and related scanning settings. Attackers often try to weaken defenses by disabling specific protection components, and tamper protection should prevent these configuration changes. The detection relies on Windefend Event ID 5013 and matches the blocked setting path values for the targeted Defender features.
references:
  - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml
author: Bhabesh Raj, Nasreddine Bencherchali, Huntrule Team
date: 2021-07-05
modified: 2022-12-06
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5013
    Value|endswith:
      - \Windows Defender\DisableAntiSpyware
      - \Windows Defender\DisableAntiVirus
      - \Windows Defender\Scan\DisableArchiveScanning
      - \Windows Defender\Scan\DisableScanningNetworkFiles
      - \Real-Time Protection\DisableRealtimeMonitoring
      - \Real-Time Protection\DisableBehaviorMonitoring
      - \Real-Time Protection\DisableIOAVProtection
      - \Real-Time Protection\DisableScriptScanning
  condition: selection
falsepositives:
  - Administrator might try to disable defender features during testing (must be investigated)
level: high
license: DRL-1.1
related:
  - id: 49e5bc24-8b86-49f1-b743-535f332c2856
    type: derived