Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings
Flags Defender tamper protection blocks to disable key Microsoft Defender Antivirus and real-time protection settings.
- Product
- windows
- Service
- windefend
- Author
- Bhabesh Raj, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2021-07-05
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies blocked attempts to change Microsoft Defender Antivirus/Real-Time Protection settings when Tamper Protection prevents the modification. Attackers may try to weaken defenses by disabling features such as realtime monitoring, behavior monitoring, or archive/network scanning, making this alert important for defense-impairment attempts. It relies on windefend telemetry for Event ID 5013 and matches the blocked setting paths corresponding to the targeted configuration changes.
Reporting behind it
- bhabeshraj.comhttps://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows windefend: Detect Tamper Protection blocks changes to Microsoft Defender settings"
id: 6f99902e-5f71-48d2-9929-9392dd67a817
status: stable
description: This rule identifies blocked attempts to change Microsoft Defender Antivirus/Real-Time Protection settings when Tamper Protection prevents the modification. Attackers may try to weaken defenses by disabling features such as realtime monitoring, behavior monitoring, or archive/network scanning, making this alert important for defense-impairment attempts. It relies on windefend telemetry for Event ID 5013 and matches the blocked setting paths corresponding to the targeted configuration changes.
references:
- https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml
author: Bhabesh Raj, Nasreddine Bencherchali, Huntrule Team
date: 2021-07-05
modified: 2022-12-06
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 5013
Value|endswith:
- \Windows Defender\DisableAntiSpyware
- \Windows Defender\DisableAntiVirus
- \Windows Defender\Scan\DisableArchiveScanning
- \Windows Defender\Scan\DisableScanningNetworkFiles
- \Real-Time Protection\DisableRealtimeMonitoring
- \Real-Time Protection\DisableBehaviorMonitoring
- \Real-Time Protection\DisableIOAVProtection
- \Real-Time Protection\DisableScriptScanning
condition: selection
falsepositives:
- Administrator might try to disable defender features during testing (must be investigated)
level: high
license: DRL-1.1
related:
- id: 49e5bc24-8b86-49f1-b743-535f332c2856
type: derived