Windows windefend: Windows Defender real-time protection disabled (Event ID 5001)

title: "Windows windefend: Windows Defender real-time protection disabled (Event ID 5001)"
id: 22d15917-1124-481b-8586-e27e51bc87b9
related:
  - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
    type: obsolete
  - id: b28e58e4-2a72-4fae-bdee-0fbe904db642
    type: derived
status: stable
description: This rule flags Windows Defender real-time protection being disabled, based on windefend events with Event ID 5001. Disabling real-time protection reduces endpoint visibility and can facilitate defense evasion by allowing malicious activity to run with less interruption. It relies on Windows security product telemetry from the windefend service reporting the disablement event.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2023-11-22
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: windefend
detection:
  selection:
    EventID: 5001
  condition: selection
falsepositives:
  - Administrator actions (should be investigated)
  - Seen being triggered occasionally during Windows 8 Defender Updates
level: high
license: DRL-1.1